Going beneath NTFS: USN Journal, dfir_NTFS, and artefact-driven investigations

1 comments

• $fuzzfactor a day ago

  This is advanced stuff that nobody should be unaware of whether they use Windows or not.