Skill

analyzing-slack-space-and-file-system-artifacts

Examine NTFS slack space, MFT entries, the USN Change Journal, and Alternate Data Streams (ADS) to recover hidden or residual data, reconstruct deleted-file metadata, and reconstruct available file-system change activity from USN records. Use during deep forensic analysis of an NTFS image when stand

Claim this listing

Connect your GitHub to prove you own or maintain this listing. We verify repo access automatically — most publishers are confirmed in seconds.

1Connect GitHub

2Submit your claim

3Auto-verified, or reviewed within 48h