Sunday Funday – Cutting across NTFS Volumes


Another Sunday Funday!

This time, we’re cutting and pasting across volumes. I decided to take a slightly different route than last week and just created two VHDs to cut and paste between. (I have no idea why I didn’t think of that last week, do all of the copying and pasting in one go and then be done with it. If there’s a hard way to do something, I will find it 🙂 ).


Understanding Orphaned Files

I was sitting in an Intro to Forensics lecture recently (in my free time, I’m crazy I know) and was explaining orphaned files to a student so thought I’d just write some stuff down about it. The main point of the post was showing how to manually modify the MFT to create orphaned entries and what they look like in FTK Imager (V3.4.2.2). Nothing groundbreaking 🙂 (more…)