Processing the $Boot file [FREE COURSE CONTENT]

In this video from our NTFS Forensics course our instructor, Divya Lakshmanan, will show you how to process the $DATA attribute of the $Boot file in the NT File System. How to locate it? Why is it useful? What can you find there? All of this and more, all in under 10 minutes, in the video below :). If you want to get your forensic skills up to this level consider joining the full course, but for now just enjoy the video! 

Check out courses instructed by Divya:

April 28, 2022
Notify of

Inline Feedbacks
View all comments
© HAKIN9 MEDIA SP. Z O.O. SP. K. 2013