Going beneath NTFS: USN Journal, dfir_NTFS, and artefact-driven investigations

Hacker News is featuring a technical analysis of NTFS forensics that explores the USN Journal and artefact-driven investigation methods using dfir-NTFS to extract evidence from Windows filesystem structures.

Listen to this story

Hear this and more stories in a personalized audio briefing.

Open The Chonkerton