Introduction to MFTECmd - NTFS MFT and Journal Forensics

This is a long overdue follow-up to "NTFS Journal Forensics" from 2019. We'll take an in-depth look at both NTFS file system journals ($UsnJrnl and $LogFile), and we'll look at how to parse the $MFT and $UsnJrnl with Eric Zimmerman's MFTECmd. Then, we'll analyze the results with Timeline Explorer.
** If you enjoy this video, please consider supporting 13Cubed on Patreon at patreon.com/13cubed. **
📖 Chapters
00:00 - Intro
06:00 - Using KAPE to Acquire NTFS $MFT and Journals
10:33 - Using MFTECmd
13:00 - Using Timeline Explorer to Analyze the Results
20:36 - Recap
🛠 Resources
NTFS Journal Forensics:
• NTFS Journal Forensics
MFTECmd:
ericzimmerman.github.io/#!ind...
AboutDFIR's MFTECmd Guide:
aboutdfir.com/toolsandartifac...
#Forensics #DigitalForensics #DFIR #ComputerForensics #WindowsForensics

[@Random-ch9my]

The quality of your videos is outstanding. Thank you for the excellent content. Truly a game changer.

[@souhaibfahfouhi7355]

masterpiece mentor

[@jasonmatthewhillman9973]

Thank you so much for putting this together. I teach CyberSecurity and my students really benefit from your hard work. You are appreciated my friend.

[@13Cubed]

You're very welcome!

[@chrisclark5135]

Thanks as always for this very helpful content!

[@magnusthorne]

This was a very useful video. Thanks!

[@kareemh91]

Thank you for your amazing content

[@Emilsurf]

Great stuff!

[@TrishLee]

Really love this 👍

[@shellz831]

EXCELLENT EXCELLENT EXCELLENT VIDEO.

[@leacossio]

Awesome video

[@edinatl2008]

Thanks

[@sai1234g24]

Hi Sir,
there are other files with the same entry number 152240 with extensions .mui and .temp. What are these files? Will usnjrnl re-use an entry number?

[@alanharper5087]

I could not get this command to work. It generated a lot of red "A module name "module name" already exists error messages. I double checked my command and made no errors. I don't know why these error messages happened.

[@ztipster]

How I see these videos in order ? or it does not matter ?

[@13Cubed]

See playlists: ua-cam.com/users/13cubedplaylists

[@marcschweiz]

Great video but gKape is much easier to use.

[@13Cubed]

Important to know how to use both, especially for acquisitions in which a GUI is not available.

[@diskdoctorprague]

A tool called dfir_ntfs could also parse $LogFile. I recammand you check that one out if you don't know it yet...