drop mft or evtx csv · mass delete bursts · timeline gaps · anti-forensics flags · export csv · runs locally
drop mft usn journal or evtx export csv