SkillMD SkillMD
light-dark-mode
Profile My skills Saved Collections Edit profile Submit a skill

Results for “mftecmd”

4 skills
mukul975
Analyzing Mft For Deleted File Recovery
Recover metadata and content of deleted files from NTFS volumes by analyzing the Master File Table, $LogFile, $UsnJrnl, and MFT slack space using forensic tools like MFTECmd and analyzeMFT.
24.6k · bundle
More results
mukul975
Analyzing Slack Space And File System Artifacts
Examine file system slack space, MFT entries, USN journal, and alternate data streams to recover hidden data and reconstruct file activity on NTFS volumes.
24.6k · bundle
mukul975
Hunting For Defense Evasion Via Timestomping
Detect NTFS timestamp manipulation (MITRE T1070.006) by comparing $STANDARD_INFORMATION vs $FILE_NAME timestamps in the MFT using analyzeMFT and Python.
24.6k · bundle
mukul975
Performing Windows Artifact Analysis With Eric Zimmerman Too
Parse and analyze Windows forensic artifacts including MFT, registry hives, prefetch files, event logs, LNK files, and jump lists using Eric Zimmerman's EZ Tools suite and KAPE.
24.6k · bundle