drop mft csv · usn journal · evtx csvs · prefetch csvs · prove that specific forensic artifacts were deliberately destroyed · mft entries for deleted tool execution logs · prefetch for cleanup utilities · usn entries for mass deletions · the meta-forensic layer · runs locally
meta-forensic artifacts
drop MFT / USN / EVTX / prefetch csv
or click
cleanup tool execution · deleted logs · USN mass delete · 1102/104 log clear
drop mft · usn · evtx · prefetch / appcompat csv