Notes - thrwt

MFT slack and Recovering Deleted Files

Can you recover a deleted file using nothing but just MFT record?

MFT

NTFS internals and uncover the forensic value hidden inside every MFT record.