Going beneath NTFS: USN Journal, dfir_NTFS, and artefact-driven investigations

A skilled attacker who has spent any time studying forensics will know to modify file timestamps. Some will go further and delete their tools, clear event logs, and rename artefacts before exfiltrati… [+15290 chars]