mactime

A collection of 3 posts

Timestamp Anomalies - $MFT

Timestamp Anomalies - $MFT

Going through my SANS 508 material I decided to have a closer look at some of the material on the Master File Table ($MFT) in the NTFS file system and how the analysis