Tuesday, October 13, 2009

Shrinking the gap: carving NTFS-compressed files

A new paper from Joachim Metz of Hoffmann Investigations titled "Shrinking the gap: carving NTFS-compressed files" is now available here. Readers may be interested to note that carving NTFS-compressed data will also be part of the advanced carving topic of the Hoffmann Forensic Sessions in November.

My thanks to Joachim for another excellent paper!

1 comment:

Rob Zirnstein said...

I like the detailed explanation, and I wonder how NTFS-encrypted files compare.