Going beneath NTFS — USN Journal, dfir_ntfs, and artefact-driven investigations

219 · · July 6, 2026, 8:08 a.m.
Summary
This blog post provides a detailed exploration of NTFS forensic artifacts, specifically focusing on the Master File Table (MFT), USN Journal, and $LogFile. It discusses how to leverage tools like dfir_ntfs and MFTECmd for investigating and detecting anti-forensic techniques. The content is highly practical and is aimed at those interested in digital forensics.