Going beneath NTFS: USN Journal, dfir_NTFS, and artefact-driven investigations

1 comments

• fuzzfactor 4 hours ago

  This is advanced stuff that nobody should be unaware of whether they use Windows or not.