Going beneath NTFS: USN Journal, dfir_ntfs, and artefact-driven investigations
andreafortuna.org
A practical deep dive into NTFS forensic artefacts: MFT, USN Journal, $LogFile, and how to combine them with dfir_ntfs and MFTECmd to detect anti-forensic techniques.