Windows Timelines in Minutes

Windows Timelines in Minutes

Explore Windows timelines and NTFS forensics in this comprehensive 57-minute conference talk from SecureWV/Hack3rcon 2016. Delve into the intricacies of NTFS file systems, learn to extract and analyze timestamp information, and master the creation of forensic timelines. Discover techniques for building databases, running queries, and visualizing data using LibreOffice Calc. Gain insights into how various file operations affect timestamps, including copying, accessing, modifying, deleting, renaming, and moving files across volumes. Equip yourself with practical skills to enhance your digital forensics capabilities and uncover crucial evidence in Windows-based investigations.