New paper: Analysis of hidden data in the NTFS file system

I think it's great that some of my work was referenced…although more is available WRT NTFS alternate data streams.

I just wish that the author had gotten my first initial correct.

Filed under "B", for "Harlan"

I've corrected that error now.

Jamie

i've created a PDF if anyone wants a copy

paul

Oh, that's very useful, I had emailed the author to see if he already had one but if you've got one available feel free to mail it to me if you wish and I'll add it to the articles index as an alternative to viewing the HTML.

Cheers,

Jamie

I'm sure there's a joke here somewhere ("How many forensic computing practitioners does it take to find a missing image…") 😉

Just a quick note, the PDF is now available at http//www.forensicfocus.com/downloads/ntfs-hidden-data-analysis.pdf and linked to from the papers page.

Thanks to Kai Wee and Paul for both supplying the file.

Cheers,

Jamie

Thanks to the person who posted this VERY informative and helpful indeed

A very nice read, thanks!

I liked it. Excellent information

Hi everybody, 8)

Thanks a lot… very new to computer forensic. i believe this article will broaden my view when dealing with a pc. 😯

Thanks again.

Note my first post…. )

i can see too
thank u