Never touched NTFS internals before, any general pointers on where to start?
Deep in the MFT walkthrough (no spoilers)
Look at the master file table entries, timestamps tell a story here.
A forensics timeline tool made this way more manageable.
Never touched NTFS internals before, any general pointers on where to start?
Look at the master file table entries, timestamps tell a story here.
Log in to reply to this topic.