---
title: "Discussion on \"Catching What Windows Hides: A Hands-On NTFS Forensics Walkthrough\" | Hashnode"
description: "Discussion on \"Catching What Windows Hides: A Hands-On NTFS Forensics Walkthrough\". Partition tables, MFT records, deleted file flags. A practical guide to finding evidence that the OS never wanted you to see."
url: "https://hashnode.com/posts/ntfs-forensics/69c0669cd9da55a9a5e8d28a"
---

[Feed](https://hashnode.com/feed) /

Discussion

# [Catching What Windows Hides: A Hands-On NTFS Forensics Walkthrough](https://rr-dfir.hashnode.dev/ntfs-forensics?utm_source=hashnode&utm_medium=feed)

Partition tables, MFT records, deleted file flags. A practical guide to finding evidence that the OS never wanted you to see.

Mar 22 · 14 min read · rr-dfir.hashnode.dev  
Read the article

-   [#windows](https://hashnode.com/tag/windows)
-   [#digital-forensics](https://hashnode.com/tag/digital-forensics)
-   [#file-system](https://hashnode.com/tag/file-system)
-   [#file-system-hierarchy](https://hashnode.com/tag/file-system-hierarchy)

## Written by

[rathsara](https://hashnode.com/@rathsara)

@rathsara · United Kingdom

  
[View profile](https://hashnode.com/@rathsara)

Security engineer focused on AppSec, cloud security, and scaling enterprise security programmes

Security engineer focused on AppSec, cloud security, and scaling enterprise security programmes in complex environments. I build and improve security capabilities across large-scale systems, with a focus on practical security engineering, visibility, and operational governance. My earlier work includes digital forensics and systems security, including OS internals and malware analysis, which continues to inform my approach to modern security problems.

## Responses

Markdown supported · ⌘↵ to post

No responses yet.