Globe Forensics Lab6.2
In this lab we use Prodiscover and Winhex to explore the MFT and learn how to locate date and time values in the metadata of a file. These steps help us to identify fragments of MFT records, which one might find in unallocated disk space or Pagefile.sys for example.