Skip to content

Acknowledgements

Juntei exists because the DFIR and open-source communities published parsers, format research, reference output, specifications, and test evidence. The projects below informed implementation, validation, field naming, or expected analyst output. Being listed does not mean their code is embedded in Juntei; consult each project for its license.

Parser foundations maintained by Yamato Security

Juntei area Maintained parser Upstream/foundation
Amcache ys-amcache-parser Security Ronin amcache-forensic
$MFT ys-ntfs-parser (mft crate) Omer Ben-Amram mft
Prefetch ys-prefetch-parser ForensicRS frnsc-prefetch
USN Journal ys-ntfs-parser (usn crate) Sootmark usn
NTFS $LogFile ys-ntfs-parser (logfile crate) Sootmark ntfslog
Directory indexes ($I30) ys-ntfs-parser (mft crate, i30 module) Index-slack research credited below
NTFS $Boot, $Secure:$SDS ys-ntfs-parser (boot and secure crates) Microsoft's MS-DTYP and the NTFS research credited below
SRUM, UAL / ESE ys-srum-parser Sootmark srum and ese
Web browsers / SQLite ys-browser-parser Sootmark browser, sqlite and plist
LNK ys-lnk-parser Sootmark shell
Jump Lists ys-jump-lists-parser Sootmark shell compound-file and Jump List work
ShimCache ys-shimcache-parser Security Ronin shimcache-forensic
Defender ys-defender-history-parser Sootmark defender
VHDX disk images (mount, auto-parse --vhdx) ys-vhdx-parser (Security Ronin vhdx-core) and ntfs-core, served with fuser Microsoft's MS-VHDX
E01 / Ex01 (mount, auto-parse --e01) ys-e01-parser ewf-image (Apache-2.0); libewf (EWF1/EWF2)
Registry ys-registry-parser Registry-format and recovery research credited below

Reference tools and independent validation

  • PyrsistenceSniper, by Hexastrike, supplied the persistence check catalogue, default allowlist, LOLBAS snapshot, and reference behavior for the native Rust persistence-hunter command. Its MIT license and copyright notice are retained in THIRD_PARTY_NOTICES/PyrsistenceSniper-LICENSE.txt. The original PersistenceSniper inspired the Python project; see the persistence acknowledgements for the full lineage.

  • Maxim Suhanov's regf specification and yarp informed registry structures, transaction-log replay, and deleted-record recovery; his dfir_ntfs was the reference for INDX records and index-slack carving.

  • Harel Segev's INDXRipper is a further reference for carving file names from index slack.
  • dfir_ntfs, Joakim Schicht's LogFileParser, and Stroz Friedberg's ntfs-linker informed $LogFile validation and interpretation; Velocidex's go-ntfs supplied public NTFS test evidence.
  • Joachim Metz / libyal projects libregf, libfsntfs, libscca, libfwsi, and libesedb provide detailed format research and independent parsing references.
  • Fox-IT's dissect.esedb, dissect.ntfs and dissect.target provided independent SRUM, UAL, $Secure:$SDS, SAM, and Defender interpretations used during validation.
  • The Sleuth Kit's fsstat was the reference for NTFS boot sectors of volumes made with mkntfs.
  • Some of Eric Zimmerman's tools established field names and examiner expectations used for comparisons.
  • regipy, python-registry, Notatin, and artemis provided registry implementations, tests, or sample interpretations.
  • LnkParse3, AbdulRhmanAlfaifi's lnk_parser and jumplist_parser, and JLECmd provided independent LNK/Jump List behavior and public test cases.
  • Security Ronin's prefetch-forensic and the forensicnomicon project informed Juntei's high-value Prefetch/Amcache/ShimCache observations.
  • defender-dump and dissect.target provide separate implementations for understanding Defender quarantine structures and safe extraction behavior.
  • Plaso, Chainsaw, and Velociraptor supplied parser comparisons, test evidence, or collection-oriented reference behavior across several artifacts.
  • Obsidian Forensics' Hindsight and Velocidex's SQLiteHunter definitions were references for browser history, downloads, cookies and form history.

Specifications and research

We thank Microsoft for publishing Open Specifications for Shell Links, Compound Binary Files, NTFS/SAM protocols, registry/service/task structures, and API documentation. We also thank the authors of AppCompatCache, Amcache, SRUM, Prefetch, registry, and NTFS forensic research that made these artifacts understandable to practitioners.

Test evidence

Public evidence from Andrew Rathbun's DFIR Artifact Museum, NIST CFReDS, Plaso, Regipy, Artemis, parser test repositories, and other properly licensed collections makes regression testing against real Windows data possible. Juntei keeps attribution/license notes beside included test files.

Contributors

Thank you to every Juntei and Yamato Security parser contributor, reviewer, issue reporter, and user who supplied edge cases. Current contributors are listed by GitHub on the Juntei contributors page.

License

Juntei is released under the Reciprocal Public License 1.5 (RPL-1.5) and copyright Shirofune Security Co., Ltd. Its source code was published under the AGPLv3 before version 1.0.0. The licenses of the crates and other third-party code and data it is built with are in THIRD_PARTY_NOTICES.