drop mft csv · detect file system tunnel cache artifacts · identify files that inherited timestamps from deleted predecessors · surface anti-forensic timestamp inheritance exploitation · runs locally
mft / usn csv
drop mft csv (optional usn journal)
or click
MFTECmd / MFTCSV · USN journal for ~15s delete→create tunnel window correlation
drop mft csv — optional usn journal csv for delete→create timing