タグ

関連タグで絞り込む (1)

タグの絞り込みを解除

フォレンジックに関するtechnerdのブックマーク (1)

  • Change Journal Records - Win32 apps

    As files, directories, and other NTFS file system objects are added, deleted, and modified, the NTFS file system enters change journal records in streams, one for each volume on the computer. Each record indicates the type of change and the object changed. The offset from the beginning of the stream for a particular record is called the update sequence number (USN) for the particular record. New r

    Change Journal Records - Win32 apps
    technerd
    technerd 2014/03/23
    Windows屋さんやってたけど、NTFSメインの時代じゃないのもあって全く知らなかった。まだまだ未知の世界はあるなあ
  • 1