$MFT
$MFT
- 1 path
$MFT- Version 1
- Eric Zimmerman
Paths on disk
1 path
References
9 links
- docs.microsoft.com/en-us/windows/win32/fileio/master-file-table(opens in new tab)
- digital-forensics.sans.org/media/DFIR-Command-Line.pdf(opens in new tab)
- andreafortuna.org/2017/10/06/macb-times-in-windows-forensic-analysis/(opens in new tab)
- andreafortuna.org/2018/06/04/using-mft-anomalies-to-spot-suspicious-files-in-forensic-analysis/(opens in new tab)
- thedigitalforensics.com/windows-forensics/timestamp-in-ntfs-system(opens in new tab)
- youtube.com/watch?v=OTea54BelTg(opens in new tab)
- sciencedirect.com/topics/computer-science/master-file-table(opens in new tab)
- tzworks.net/prototype_page.php?proto_id=46(opens in new tab)
- youtube.com/watch?v=xW5UwDztkX4(opens in new tab)