Google, IBM & Meta Certificates — All 10,000+ Courses at 40% Off
One annual plan covers every course and certificate on Coursera. 40% off for a limited time.
Get Full Access
Explore advanced digital forensics techniques for recovering deleted attacker files in this 52-minute conference talk from Bloomcon 2017. Delve into the intricacies of NTFS metadata files, including SMF and $130, and learn about special cases like SDELETE. Examine file system artifacts, Windows Defender's role in APT29 investigations, and leverage the Application Compatibility Cache and Windows Prefetch for enhanced evidence recovery. Gain valuable insights into the causes of file deletion and discover effective strategies for reconstructing digital crime scenes.
