[forensics] NTFS $I30 Index Attributes: Evidence of Deleted and Overwritten Files

NTFS $I30 Index Attributes: Evidence of Deleted and Overwritten Files | Forensic Methods
screenshot