@port139 Blog

基本的にはデジタル・フォレンジックの技術について取り扱っていますが、記載内容には高確率で誤りが含まれる可能性があります。

2018-07-01から1ヶ月間の記事一覧

Jumplist and File copy

Note:I translated Japanese into English using Google Translate.Thank you, Google. I did not know about the artifacts in the Jumplist mentioned below. http://www.hecfblog.com/2018/07/daily-blog-426-directory-copy-and-paste.html So new as of…

NTFS $REPARSE_POINT and Symbolic link(2)

Note:I translated Japanese into English using Google Translate.Thank you, Google. Last week I checked the symbolic link using the mklink command. The Symbolic link reparse data has a field of Print name, but the mklink command can not set …

NTFS $REPARSE_POINT and Symbolic link

Note:I translated Japanese into English using Google Translate.Thank you, Google. Today, I would like to confirm the NTFS symbolic link.Copy the JPEG file to the sample VHD Disk. Use the mklink command for this JPEG file to create a symbol…

$ATTRIBUTE_LIST and deleted record

Note:I translated Japanese into English using Google Translate. Thank you, Google. I will use the sample VHD Disk created last week. $ATTRIBUTE_LIST of FILE record 39 is as follows. Several $FILE_NAME saved in FILE record number 40. Filena…

$MFT と $ATTRIBUTE_LIST

Note:For experimental purposes, I use Google Translate to convert Blog to English.Unfortunately, I do not know whether it was translated into an appropriate English expression. Please let me know if there is a more appropriate expression. …