CTFs & Images

Test Images
This is a simple VHDX file with some files that have been named according to what was done with them. For text and Word files, make sure you read the contents of the file so you see what I did to them and can attribute that activity to MFTECmd output that's included.

For more on KAPE, check out my guide on AboutDFIR here .

For more on Timeline Exporer, check out my guide on AboutDFIR here .

MFT Explorer/MFTECmd guide coming soon!

If there are any issues or suggestions for improvement, please create an Issue or do a Pull Request with updates of your own.