Forensics

TScopy: Python script used to parse the NTFS $MFT file

Introducing TScopy It is a requirement during an Incident Response (IR) engagement to have the ability to analyze files on the filesystem. Sometimes these files are locked by the operating...