This new video by Richard Davis from “Introduction to Windows Forensics” series covers the basic information you need to know about such important artifact? as Windows NTFS Index Attributes. You’ll walk through extraction of a $I30 file from a Windows 10 virtual machine, and analyze the contents of the index looking for evidence of deleted or overwritten files:

Load More Related Articles
Load More In Videos

Leave a Reply

Your email address will not be published. Required fields are marked *