domains / families / security / analyzing-slack-space-and-file-system-artifacts

analyzing-slack-space-and-file-system-artifacts

separate

Examine NTFS slack space, MFT entries, the USN Change Journal, and Alternate Data Streams (ADS) to recover hidden or residual data, reconstruct deleted-file metadata, and reconstruct available file-system change activity from USN records. Use during deep forensic analysis of an NTFS image when standard file recovery is insufficient, such as hunting for data hidden in ADS.

When to use

• When searching for hidden or residual data in file system slack space
• For analyzing NTFS Master File Table (MFT) entries for deleted file metadata
• When reconstructing file operations from the USN Change Journal
• For detecting Alternate Data Streams (ADS) used to hide data or malware
• During deep forensic analysis requiring examination beyond standard file recovery

Skill page

Source