2011-09-28 [forensics] NTFS $I30 Index Attributes: Evidence of Deleted and Overwritten Files sec NTFS $I30 Index Attributes: Evidence of Deleted and Overwritten Files | Forensic Methods