" ntfs-linker operates off of a directory of input containing $UsnJrnl, $Logfile, and $MFT. The $UsnJrnl should be the $J alternate data stream and it can be clipped to avoid copying the sparse portions." ?strozfriedberg.github.io/ntfs-linker/
Be the first to review this listing!
© 2020 Copyright 2020 | DFIR Training