NTFS Object IDs in EnCase – Part 3
In a previous post, I showed you how to make a condition to find all files in an NTFS volume that have Object IDs associated with them in NTFS. In this post, I will be showing you how to create a condition to search through the values of the Object IDs to filter on specific … Continue reading “NTFS Object IDs in EnCase – Part 3” Continue reading NTFS Object IDs in EnCase – Part 3