drop two mft/manifest csvs from shadow copies · added deleted modified renamed · timestomp detection · ransomware patterns · csv export · runs locally
snapshots
drop snapshot A then B (MFT CSV)
or click
A: — · B: —
drop snapshot A (earlier) and snapshot B (later) MFT/manifest CSV