A new paper from Joachim Metz of Hoffmann Investigations titled "Shrinking the gap: carving NTFS-compressed files" is now available here. Readers may be interested to note that carving NTFS-compressed data will also be part of the advanced carving topic of the Hoffmann Forensic Sessions in November.
My thanks to Joachim for another excellent paper!
1 comment:
I like the detailed explanation, and I wonder how NTFS-encrypted files compare.
Post a Comment