Skip to content
Collect NTFS forensic information with osquery
blog.trailofbits.com | blog | #incident-response | #windows | #digital-forensics | #forensics | #osquery | #ntfs | #alternate-data-streams | #crypsis
Summary
Built with Crypsis, this osquery extension exposes NTFS forensic artifacts—filename timestamps, security descriptors, Alternate Data Streams, and stale index entries—to incident responders.
- Published
- Collected