NTFS and File System Analysis - Windows NTFS is the most common file system used on Windows networks and is the source of many forensic artifacts during incident response. During this stream, Leo covered the basics of the file system and NTFS which are derived from the TrustedSec's upcoming training at ISS.