$MFT timeline
`MFTECmd.exe -f "<copied>\$MFT" --csv G:\Output --csvf mft.csv` and for body format `MFTECmd.exe -f "<copied>\$MFT" --body G:\Output --bodyf mft.body`; filter in Timeline Explorer for suspicious directories (Temp, Users\Public, $Recycle.Bin), .exe/.dll/.ps1/.bat extensions, and single- or two-character executable names
$SI/$FN timestamp comparison
Compare the `SI_Created`, `SI_Modified`, `FN_Created`, `FN_Modified` columns in the CSV output; `SI_Created < FN_Created` is a strong timestomping indicator; if both Win32 and DOS 8.3 $FN copies exist, examine both
$UsnJrnl timeline
`MFTECmd.exe -f "<copied>\$J" -m "<copied>\$MFT" --csv G:\Output --csvf usnjrnl.csv`; focus areas: `FILE_CREATE`+`FILE_DELETE` pairs (created then deleted), `RENAME_OLD_NAME`+`RENAME_NEW_NAME` (tool renamed), `BASIC_INFO_CHANGE` (timestamp/attribute change), Prefetch folder `FILE_DELETE` (Prefetch cleared), `STREAM_CHANGE`+`NAMED_DATA_EXTEND` (ADS created)
Recover old USN records
$J is a sparse file; Windows deallocates records older than ~32 MB but those clusters are usually recoverable; MFTECmd also parses the unallocated area; hundreds of days of data may be accessible
$LogFile analysis
`MFTECmd.exe -f "<copied>\$LogFile" --csv G:\Output --csvf logfile.csv`; look for operation codes `InitializeFileRecordSegment` (new file), `DeleteIndexEntryAllocation`+`DeallocateFileRecordSegment` (deletion), `CreateAttribute` (ADS creation, contains `:` in name); if $J has been cleared but $LogFile is present, the `DeallocateFileRecordSegment` pattern confirms journal clearing
LSN analysis
If the LSN value in the file's MFT record is inconsistent with the LSN values of neighboring files for the period the timestamp indicates, this constitutes indirect evidence that the timestamp was subsequently changed; it is a second verification channel independent of $J
Prefetch analysis
`PECmd.exe -d "<copied>\C\Windows\Prefetch" --csv G:\Output --csvf prefetch.csv`; produces two CSVs: per-file and `prefetch_Timeline.csv` (8 execution timestamps); priority search topics: suspicious tool names (mimikatz, psexec, certutil, net), system tools running from non-standard locations, multiple .pf files with the same name (note svchost.exe), suspicious paths in the Referenced files field, and `ZONE.IDENTIFIER` ADS references (downloaded from the internet)
ShimCache analysis
`AppCompatCacheParser.exe -f "<SYSTEM hive>" --csv G:\Output --csvf shimcache.csv`; filter for executables in non-standard locations; same `LastModifiedTime` + different name → renaming suspicion; smaller Cache Entry Position value = more recent entry; ShimCache presence is not execution evidence for Windows Vista+ — it only says "the tool was seen here"; if Prefetch is absent, cross-validate with Amcache
Amcache analysis
`AmcacheParser.exe -f "<Amcache.hve>" --csv G:\Output`; `amcache_UnassociatedFileEntries.csv` is the most valuable table (executed applications); `amcache_DriverBinaries.csv` lists loaded drivers (rootkit investigation); match SHA1 hashes against VirusTotal or corporate TI; files above ~31.4 MB are not hashed
$I30 deleted file traces
Deleted entries marked with `IsDeleted=True` in the MFTECmd `$MFT` parse; "ghost entries" remaining in the $I30 B-tree slack space contain four timestamps, an MFT number, and the file name; directory index traces can be recovered even if the MFT record has been zeroed
ADS discovery
`dir /r <suspicious_directory>` or `Get-Item "C:\target" -Stream *`; multiple `$DATA` attributes in the MFTECmd $MFT output indicate the presence of ADS; a combined `STREAM_CHANGE`+`NAMED_DATA_EXTEND` record in $J also confirms that an ADS was created
