Going beneath NTFS: USN Journal, dfir_NTFS, and artefact-driven investigations(andreafortuna.org)
15 pointsby ankitg127 hours ago1 comment
  • fuzzfactor6 hours ago
    This is advanced stuff that nobody should be unaware of whether they use Windows or not.