drop logfile operation csv and mft csv · use log sequence numbers as tamper-resistant event ordering · prove which file system events occurred first · expose timestamp inversions that are physically impossible · validate or invalidate claimed event sequences · runs locally
lsn artifacts
drop logfile · mft · usn csv
ntfs-logfile-parser output · MFTECmd exports
drop logfile operation csv · mft csv · usn journal csv