The $MFT — the one artifact I check first on every Windows investigation

If you work in DFIR and you are not comfortable reading the Master File Table, this article is for you. We will go from what it is, to what…