drop mft or artifact csv · detect files with timestamps in the future · identify timestamps before system installation · surface impossible date values · correlate with system clock evidence · runs locally
drop mft or artifact csv