Operator On The Wire
Join
← Back to Knowledge Base
BLUE TEAM / DFI / MEMORY / DUMP / VOLATILITY / Files

mftscan.residentdata

This will show all resident file's in MFT

# vol3
vol -f target windows.mftscan.residentdata