Month: August 2017

Understanding Orphaned Files

I was sitting in an Intro to Forensics lecture recently (in my free time, I’m crazy I know) and was explaining orphaned files to a student so thought I’d just write some stuff down about it. The main point of the post was showing how to manually modify the MFT to create orphaned entries and what they look like in FTK Imager (V3.4.2.2). Nothing groundbreaking 🙂 (more…)