@port139 Blog

基本的にはデジタル・フォレンジックの技術について取り扱っていますが、記載内容には高確率で誤りが含まれる可能性があります。

2018-08-01から1ヶ月間の記事一覧

NTFS $LogFile and DataRun

Note:I translated Japanese into English using Google Translate.Thank you, Google. Use $LogFile to check overwriting of the cluster. Two images are used for the test. These two image files are almost the same size. Copy Dragonfly.jpg to for…

NTFS USN Journal and ObjectID

Note:I translated Japanese into English using Google Translate.Thank you, Google. Enable USN Journal on sample NTFS volumes and Copy Example.jpg to the Pictures folder. Check the status of ObjectID, ObjectID is not set. Using USN Analytics…

Jumplist and Clear File Explorer history

Note:I translated Japanese into English using Google Translate.Thank you, Google. Hop Step Jumplist. Display file 5f7b5f1e01b83767.automaticDestinations-ms with HEX.Only 'DestList' exists in this file. I started explorer and I looked up 4 …