Smack your head with USN Journal: Everything you ever wanted to know about this forensic artifact

Starting with NTFS V 3.0 (Also known as NTFS 5.0) Microsoft introduced several new features in the file system to make it more robust, reliable and efficient. This included Support for disk quotas, EFS, Sparse files, reparse points and Update sequence number (USN) journaling. While NTFS v 3.0 supports all these features the actual implementation […]

Read More »