drop evtx csv and mft csv · event 4616 time changes · mft si_mftmodified anomalies · corrected timeline · runs locally
evtx / mft csv
drop evtx csv · mft csv
or click
security 4616 · kernel-general 1 · time-service 37 · mft SI_MFTModified scan
drop security/system evtx csv and mft csv — multiple files ok