A new paper from Joachim Metz of Hoffmann Investigations titled “Shrinking the gap: carving NTFS-compressed files” is now available here. Readers may be interested to note that carving NTFS-compressed data will be part of the advanced carving topic of the Hoffmann Forensic Sessions in November.
