> For the complete documentation index, see [llms.txt](https://www.unh4ck.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://www.unh4ck.com/dfir.md).

# DFIR

- [DFIR-01 : $MFT](https://www.unh4ck.com/dfir/dfir-01-usdmft.md): The Master File Table contains information about every file and folder on the system.
- [DFIR-02 : Journal Forensics](https://www.unh4ck.com/dfir/dfir-02-journal-forensics.md): Using $LogFile and $UsnJrnl during digital investigations
- [DFIR-03: RDP Authentication Artifacts](https://www.unh4ck.com/dfir/rdp-authentication-artifacts.md): I created a Mindmap that represents different artifacts related to RDP authentication with NLA enabled or disabled to help collect and analyze forensic artifacts during DFIR engagements