DFSP # 326 - MFT

17/05/2022 14 min
DFSP # 326 - MFT

Listen "DFSP # 326 - MFT"

Episode Synopsis

This week I’m covering the Master file table as a core forensic artifact for Windows investigations. This artifact has value is both a primary and secondary artifact and offers opportunity to decode evidence in a number of different situations. In this episode I’m covering the forensic basics, some use cases and tools you can use to bring the value of the artifact to its full potential.