13 个 · 按相关度排序
Analyze NTFS file records and change journals to investigate deleted files on Windows disks. Recover surviving metadata and content where possible, reconstruct file activity timelines, and compare timestamps for signs of deliberate manipulation.
中文简介正在准备中。当前显示英语简介。
Analyze the NTFS Master File Table ($MFT) to recover metadata and content of deleted files by examining MFT record entries, $LogFile, $UsnJrnl, and MFT slack space using MFTECmd, analyzeMFT, and X-Ways Forensics.
中文简介正在准备中。当前显示原文说明。
Analyze the NTFS Master File Table ($MFT) to recover metadata and content of deleted files by examining MFT record entries, $LogFile, $UsnJrnl, and MFT slack space using MFTECmd, analyzeMFT, and X-Ways Forensics.
中文简介正在准备中。当前显示原文说明。
Analyze the NTFS Master File Table ($MFT) to recover metadata and content of deleted files by examining MFT record entries, $LogFile, $UsnJrnl, and MFT slack space using MFTECmd, analyzeMFT, and X-Ways Forensics.
中文简介正在准备中。当前显示原文说明。
Examine NTFS disk images for residual or hidden data beyond standard file recovery. Analyze file metadata, change records, unused space within allocated storage, and Alternate Data Streams to reconstruct available activity and identify suspicious timestamp differences.
中文简介正在准备中。当前显示英语简介。
Examine file system slack space, MFT entries, USN journal, and alternate data streams to recover hidden data and reconstruct file activity on NTFS volumes.
中文简介正在准备中。当前显示原文说明。
Disk imaj forensics — The Sleuth Kit (TSK), Autopsy, deleted file recovery, MFT/inode analizi, slack space, EWF/RAW imajlar
中文简介正在准备中。当前显示原文说明。
Examine file system slack space, MFT entries, USN journal, and alternate data streams to recover hidden data and reconstruct file activity on NTFS volumes.
中文简介正在准备中。当前显示原文说明。
Examine file system slack space, MFT entries, USN journal, and alternate data streams to recover hidden data and reconstruct file activity on NTFS volumes.
中文简介正在准备中。当前显示原文说明。
Examine Windows shortcuts and Jump Lists, records of recently used files, to reconstruct user activity. Extract paths, timestamps, and device details with LECmd and JLECmd, including traces that remain after target files are deleted.
中文简介正在准备中。当前显示英语简介。
Review how evidence can be altered during authorized security exercises on Windows and Linux. Covers logs, timestamps, memory, disk records, and network traces, alongside the signs defenders use to detect manipulation.
中文简介正在准备中。当前显示英语简介。
Think and work like an expert Condensed Matter Physicist. Use when a task calls for Condensed Matter Physicist judgment. Reasons from Bloch bands, quasiparticles, and symmetry through ARPES/STM/neutron/transport workflows, VASP/QE/Wannier90/DMFT, and Materials Project/ICSD/MPDS while treating matrix-element artifacts, Mott vs. DFT gaps, pseudogap vs. SC gap, and Planckian bad-metal transport as first-class failure modes.
中文简介正在准备中。当前显示原文说明。
Anti-forensics and evidence destruction techniques for red team operators conducting authorized engagements. Covers log clearing on Windows (wevtutil, Clear-EventLog, ETW provider patching) and Linux (journal truncation, utmp/wtmp binary editing, syslog manipulation), timestamp manipulation via Timestomp and SetMACE to defeat timeline analysis, filesystem-level anti-forensics including NTFS Alternate Data Streams for payload hiding and secure deletion with sdelete/shred, memory artifact removal to counter live forensics, disk artifact manipulation targeting MFT entries and USN journal records, network forensics evasion through encrypted C2 channels and DNS-over-HTTPS tunneling, and anti-VM/sandbox detection to avoid dynamic analysis environments. Tools: Timestomp, wevtutil, sdelete, shred, MimiPenguin, Invoke-Phant0m. Aligns to MITRE ATT&CK T1070 (Indicator Removal), T1027 (Obfuscated Files or Information), T1497 (Virtualization/Sandbox Evasion). Each technique includes the forensic artifact it targets, t...
中文简介正在准备中。当前显示原文说明。