File System Forensics

analyzing-mft-for-deleted-file-recovery helps recover deleted-file metadata and possible path or content evidence by analyzing NTFS $MFT records, $LogFile, $UsnJrnl, and MFT slack space. Built for DFIR and Security Audit workflows with MFTECmd, analyzeMFT, and X-Ways Forensics.