Getting to know your NTFS INDX Records - Willi Ballenthin

2 May 2012

This was the first special request presentation, Willi originally presented this at NYC4SEC, it received lots of positive response and he kindly offered to come and give it again for a special DFIROnline session. Willi is a great presenter and this is a good reminder of how important it is to look beyond the MFT. The slides are also online:

Willi's website: