Is it possible to know when a file in a NTFS filesystem was deleted? For example, if you have the file in the recycle bin you have the metadata file that stores when the file was sent to the recycle ...
How can I temporary disable folders links like Users\All Users in order to perform a forensic analysis?
I'm doing a forensic analysis of a hard drive that I have imaged to a dd image. The image is a NTFS filesystem that I mount in my Windows system with FTK Imager in read-only mode. Then, I search in ...
I am trying to view an NTFS master file table. Each tool I have used so far extracts all of the entries, but puts non standard headers such as STANDARD_INFORMATION_ON instead of say ...