Skip to content
corpus.blog
Sign in Claim your blog
Record · andreafortuna.org

Going beneath NTFS: USN Journal, dfir_ntfs, and artefact-driven investigations

andreafortuna.org · 6 July 2026 · 12 min read

A post on andreafortuna.org, published 6 July 2026, has not been cited by any blog yet (corpus.blog, measured 12 October 2026).

A record is what was published and who pointed at it. The text of the post is not shown here: read it at the source, or at its Wayback capture.

Read at andreafortuna.org (opens in a new tab) Wayback capture (opens in a new tab)

0blogs citing

Citing blogs and links by period
Period Blogs Links
All time00
Last 90 days00
Last 30 days00
Last 7 days00
Figures for this page
Words blogs link it with0
External links3
Length2,651

Cited by

No blog we hold has cited this post yet.

Links from this post

Link
Host
Elsewhere on andreafortuna.org (6)
https://andreafortuna.org/2017/10/11/some-thoughts-about-ntfs-filesystem/ Read at andreafortuna.org (opens in a new tab)
andreafortuna.org
https://andreafortuna.org/2025/09/06/usn-journal/ Read at andreafortuna.org (opens in a new tab)
andreafortuna.org
https://andreafortuna.org/2021/06/05/dfir_ntfs-a-forensic-parser-for-ntfs-filesystems/ Read at andreafortuna.org (opens in a new tab)
andreafortuna.org
Why DFIR teams need to look beyond the MBR when analyzing modern wipers Read at andreafortuna.org (opens in a new tab)
andreafortuna.org
https://andreafortuna.org/2018/05/02/some-thought-about-file-carving/ Read at andreafortuna.org (opens in a new tab)
andreafortuna.org
https://andreafortuna.org/2017/10/02/volume-shadow-copies-in-forensic-analysis/ Read at andreafortuna.org (opens in a new tab)
andreafortuna.org

Similar posts

NTFS
Internals for Interns
16 Mar 2026
The boring state of stalled timelines…
hexacorn.com
3 Oct 2026
Brucon: Anti-Forensics (and Anti-Anti-Forensics) Techniques
dfir.ch
23 Apr 2026
Field Notes: From AV Alert to Impacket
dfir.ch
11 Sept 2026
New Attack Can Track You Across Operating Systems Without Elevated Privileges
privacyguides.org
28 Sept 2026
How Data Lineage Catches a File That’s Trying Not to Be Found
netskope.com
28 Sept 2026
Microsoft engineer explains why Windows gives new files the date of ones you deleted
windowslatest.com
20 Sept 2026
The most important file is the one that isn't there
stillig.net
26 Aug 2026
[136] Metadata Falsificada: The Cover-Up File in Gino v. Harvard
datacolada.org
3 Jul 2026

Something wrong here? Report a problem