Deleted Evidence - Fill in the Map to Luke Skywalker

Deleted Evidence - Fill in the Map to Luke Skywalker

Explore advanced digital forensics techniques for recovering deleted attacker files in this 52-minute conference talk from Bloomcon 2017. Delve into the intricacies of NTFS metadata files, including SMF and $130, and learn about special cases like SDELETE. Examine file system artifacts, Windows Defender's role in APT29 investigations, and leverage the Application Compatibility Cache and Windows Prefetch for enhanced evidence recovery. Gain valuable insights into the causes of file deletion and discover effective strategies for reconstructing digital crime scenes.