11 · Anti-Forensics
Detecting Windows Anti-Forensics: What Survives the Cleanup
Detect log clearing, timestomping, secure deletion, VSS deletion and Defender tampering on Windows, mapped to MITRE ATT&CK, with the traces each one leaves.
Articles tagged: #timestomping
05 · NTFS & File System
NTFS Forensics: $MFT, USN Journal and $LogFile Explained
Read NTFS like an examiner: MFT record structure, $SI vs $FN timestamps, timestomping checks, USN reason flags, $LogFile, $I30 slack and deleted files.