CyCube
Intermediate

Disk Analysis

NTFS forensics: collect artifacts and analyze $MFT, $USNJRNL, and $LOGFILE with tools to reconstruct activity and detect tampering.

Duration
4h
Labs
4
Videos
4
Quizzes
1

Skills Acquired

  • Understand the internal structure of NTFS and its key components
  • Collect and extract forensic disk artifacts using FTK Imager and CLI tools
  • Analyze $MFT entries to uncover file metadata and timestamp history
  • Investigate file system changes using $USNJRNL and $LOGFILE
  • Detect suspicious activity through MACB timeline reconstruction and anomaly spotting

Curriculum

  1. Disk Structure
    • NTFS in depth
    • Hidden system files and timestamps
    • MFT acquisition tools and timeline correlation
  2. Disk Analysis
    • $MFT analysis with forensic tools
    • $USNJRNL parsing and investigations
    • $LOGFILE analysis for anomaly detection
    • Disk analysis with Autopsy and The Sleuth Kit

Included in these pathways