Anatomy of an NTFS FILE Record - Windows File System Forensics

Good morning,


It’s time for a new 13Cubed episode! In this one, we’ll talk about the structure and composition of an NTFS FILE record. Then, we'll take a look at a sample record for a resident file and learn how to manually extract the important attributes. Note that there is also an accompanying cheat sheet which may come in handy (see the video’s description)!


Episode:
[https://www.youtube.com/watch?v=l4IphrAjzeY](https://www.youtube.com/watch?v=l4IphrAjzeY)


Episode Guide:
[https://www.13cubed.com/episodes/](https://www.13cubed.com/episodes/)


13Cubed YouTube Channel:
[https://www.youtube.com/13cubed](https://www.youtube.com/13cubed)


13Cubed Patreon (Help support the channel and …

computerforensics file system forensics ntfs system windows