Resident Data on NTFS File Systems – CyberDay 2023
Classification
Resource Type
Technical Details
Evidence Source
- Disk / Storage
File Format
- RAW / DD / IMG
- Archive / Mixed Files
Download Size
243.6 KB
Release Year
Source and Access
Artifacts and Topics
- File System
- Deleted Data
Host
Source Page
Primary Download
Hash
SHA1: 1461c8c77e5f092581a083df6a12ad019cd6405d
Last Verified
August 08, 2026
Topics
CIRCL training exercise for examining how NTFS resident data behaves as a file grows and changes over time. The package includes an empty NTFS disk image and text files used to reproduce the lab, with exercises focused on the Master File Table, resident and non-resident $DATA, and recovery of older content remaining inside MFT records.