Operator On The Wire
Join
← Back to Knowledge Base
BLUE TEAM / DFI / ARTEFACT / WINDOWS / FILE SYSTEM

LogFile

jschicht/LogFileParser

  • Give LogFile
  • Give MFT
  • Reconstruct data runs ON
  • Extract non-resident updates of min size: 2 ON