0
votes
2answers
105 views

How to know when a file was deleted in a NTFS filesystem?

Is it possible to know when a file in a NTFS filesystem was deleted? For example, if you have the file in the recycle bin you have the metadata file that stores when the file was sent to the recycle ...
1
vote
1answer
30 views

How can I temporary disable folders links like Users\All Users in order to perform a forensic analysis?

I'm doing a forensic analysis of a hard drive that I have imaged to a dd image. The image is a NTFS filesystem that I mount in my Windows system with FTK Imager in read-only mode. Then, I search in ...
3
votes
2answers
2k views

How can I view the NTFS $MFT using correct field names?

I am trying to view an NTFS master file table. Each tool I have used so far extracts all of the entries, but puts non standard headers such as STANDARD_INFORMATION_ON instead of say ...