Lesson 5 of 9 · 30m

Disk Forensics: Artifacts and Deleted Files

Read $MFT, Prefetch, Shimcache, and bash history; recover deleted files with the Sleuth Kit; spot timestomping.