In this video from our NTFS Forensics course our instructor, Divya Lakshmanan, will show you how to process the $DATA attribute of the $Boot file in the NT File System. How to locate it? Why is it useful? What can you find there? All of this and more, all in under 10 minutes, in the video below :). If you want to get your forensic skills up to this level consider joining the full course, but for now just enjoy the video!