$MFTMirr
$MFTMirr
- 1 path
$MFTMirr- Version 1
- Teo Kia Meng
Paths on disk
1 path
Notes
$MFTMirr is a redundant copy of the first four (4) records of the MFT.
References
5 links
- flatcap.org/linux-ntfs/ntfs/files/mftmirr.html(opens in new tab)
- digital-forensics.sans.org/media/DFIR-Command-Line.pdf(opens in new tab)
- andreafortuna.org/2017/10/06/macb-times-in-windows-forensic-analysis/(opens in new tab)
- andreafortuna.org/2018/06/04/using-mft-anomalies-to-spot-suspicious-files-in-forensic-analysis/(opens in new tab)
- thedigitalforensics.com/windows-forensics/timestamp-in-ntfs-system(opens in new tab)