Training
Windows Master File Table (MFT) Analysis
Training Overview
The "Windows Master File Table (MFT) Analysis" training comprehensively teaches how to analyze MFT in digital forensic investigations and how to extract evidence from these analyses. The training starts with the basic concepts of MFT, involves details of the MFT structure, the use of MFT Explorer, analysis of file metadata, and the examination of the USN Journal.
What You Will Learn
- The structure of the Master File Table (MFT) in the NTFS file system.
- How to use MFT Explorer and Active@ Disk Editor for analysis.
- How to interpret file metadata and timestamps from MFT records.
- The role and analysis of the USN Journal.
Who is this for?
- Digital Forensic Investigators.
- Incident Responders.
- Security researchers studying file system forensics.
Prerequisites
- A deep understanding of the NTFS file system.
- Prior experience in digital forensics.
Tools You Will Use
- MFT Explorer
- Active@ Disk Editor
- analyzeMFT.py (Conceptual)
Training Sections
- Introduction
- MFT
- MFT Explorer
- Active@ Disk Editor
- USN Journal
- Exam