16章

Appendix

MFT解析ツール

• FTK Imager
  • https://www.exterro.com/digital-forensics-software/ftk-imager
• fte (FILETIME Extractor)
  • http://www.kazamiya.net/fte

NTFS関連情報

• NTFSの概要（Microsoft）
  • https://docs.microsoft.com/ja-jp/windows-server/storage/file-server/ntfs-overview
• Digital Forensics: Detecting time stamp manipulation（SANS）
  • https://www.sans.org/blog/digital-forensics-detecting-time-stamp-manipulation/
• File Times - Win32 apps | Microsoft Docs
  • https://docs.microsoft.com/en-us/windows/win32/sysinfo/file-times