Jan. 14, 2024, 9:55 p.m. | /u/No-Concentrate-7555

Computer Forensics www.reddit.com

I'm doing a DFIR course and they give you $mft. How do I find the MFT on my local machine so I can give it to mftecmd? Is there an easy way to do this? Most of what I see online says to take an image and use FTKImager.

Any advice is helpful.

advice can computerforensics course dfir doing easy find image local machine mft question

Cybersecurity Consultant

@ Devoteam | Cité Mahrajène, Tunisia

GTI Manager of Cybersecurity Operations

@ Grant Thornton | Phoenix, AZ, United States

(Senior) Director of Information Governance, Risk, and Compliance

@ SIXT | Munich, Germany

Information System Security Engineer

@ Space Dynamics Laboratory | North Logan, UT

Intelligence Specialist (Threat/DCO) - Level 3

@ Constellation Technologies | Fort Meade, MD

Cybersecurity GRC Specialist (On-site)

@ EnerSys | Reading, PA, US, 19605