In this cheat sheet, we'll take a look at some of the key tools and techniques that can be used to perform Azure Incident Response.

Windows file system forensics is a vital aspect of digital forensics investigations, as it allows examiners to recover and analyze evidence.

The forensic value of MFT journals is that they can be used to find evidence of file creations, deletions, renames, etc.

We are going to extract this valuable information with a well-known tool made by Eric Zimmermann, and use a python-based addon I created.