References
Specs, docs, and tools to read when you work on nemo. Each section says which nemo package or page it backs.
Filesystem specifications
NTFS
Used by internal/filesystem/ntfs.
- NTFS Documentation by Russon and Fledel. The best free description of the on-disk layout.
- Data runs: how non-resident attributes map to clusters.
$DATAattribute: where alternate data streams live.$STANDARD_INFORMATIONand$FILE_NAME: the two timestamp copies behind timestomp detection.- libfsntfs format notes: a second, more formal write-up to cross-check against.
- MS-FSCC, File System Control Codes: Microsoft’s spec for streams and FILETIME.
- File streams on Microsoft Learn: the
file:streamsyntax from the API side.
ext4
Used by internal/filesystem/ext4.
- ext4 documentation index in the Linux kernel docs.
- Superblock: feature flags and geometry.
- Inodes: fields, extra area, and timestamp encoding.
- Dynamic structures: the extent tree and inline data.
- Directory entries: linear and HTree directories.
- Extended attributes: the in-inode and external block layouts.
APFS
Used by internal/filesystem/apfs.
- Apple File System Reference: Apple’s official spec.
- libfsapfs format notes: community notes that fill gaps in the official spec.
Hiding techniques
Background for the technique pages.
- MITRE ATT&CK T1564.004, NTFS File Attributes: how attackers use alternate data streams.
- MITRE ATT&CK T1070.006, Timestomp: how timestomping is used and detected.
- Slack space on Wikipedia: a short intro to the concept.
OS interfaces
Used by the live-mode code. See Modes.
xattr(7): Linux extended attribute namespaces.utimensat(2): setting times withUTIME_OMIT.statx(2): birth time and mount ID.setattrlist(2): how macOS sets creation time.SetFileTime: the Win32 timestamp call.
Tools and datasets
- The Sleuth Kit and its documentation: the reference forensic toolkit. Use
fls,istat, andblklsto cross-check nemo’s output. - hide-and-seek-dataset: the public corpus nemo benchmarks against. See Validation.