1. Presented by Kofi Appiah Nuamah NTFS Forensics with Disk Explorer Project 3.1

2. Intrusion investigations can involve the investigation of file systems for deleted data, hidden files and alternate data streams. The assignment was to create, delete and recover data in NTFS. An Alternate Data stream will also be created and investigated using Runtime’s NTDisk Explorer. Introduction

3. The created file viewed in Disk ExplorerCreating the folder and text file Demonstration

4. Exploring the $LOG records for the fileNavigating the $MFT for the deleted mytxt.txt file Demonstration

5. Viewing the ADS content in notepadCreating the Alternate Data Stream Demonstration

6. Viewing the ADS HeaderInvestigating the Alternate Data Stream Demonstration

7. Viewing the ADS BodyInvestigating the Alternate Data Stream Demonstration The body reveals the hidden text as; “ Hello World –I have now hidden this data”.

8. From the exercise, it can be seen how a suspect may hide data or delete them in order to obstruct an investigation. It is important for investigators to know how to manipulate file systems and data structures to retrieve evidence. Conclusion

9. Carvey, H. (2005). Knowing what to look for. In Windows Forensics and Incident Recovery (pp. 301-378). Boston, MA: Pearson Education. Reference