https://github.com/Invoke-IR/ForensicPosters

https://github.com/Invoke-IR/ForensicPosters

Last synced: 6 months ago
JSON representation

• Host: GitHub
• URL: https://github.com/Invoke-IR/ForensicPosters
• Owner: Invoke-IR
• License: bsd-3-clause
• Created: 2015-05-06T03:13:53.000Z (over 10 years ago)
• Default Branch: master
• Last Pushed: 2024-11-21T16:48:15.000Z (12 months ago)
• Last Synced: 2025-02-25T23:41:28.119Z (8 months ago)
• Size: 50.9 MB
• Stars: 441
• Watchers: 40
• Forks: 81
• Open Issues: 3
• Metadata Files:
  • Readme: README.md

Awesome Lists containing this project

• ForensicsTools - ForensicPosters - Posters of file system structures (Resources / Other)

README

          
![alt text](https://cdn.rawgit.com/Invoke-IR/ForensicPosters/master/src/BootSectors/MasterBootRecord.svg "Master Boot Record")

![alt text](https://cdn.rawgit.com/Invoke-IR/ForensicPosters/master/src/BootSectors/GuidPartitionTable.svg "Guid Partition Table")

![alt text](https://cdn.rawgit.com/Invoke-IR/ForensicPosters/master/src/NTFS/NTFSVolumeBootRecord.svg "$Boot (Volume Boot Record)")

![alt text](https://cdn.rawgit.com/Invoke-IR/ForensicPosters/master/src/NTFS/MasterFileTable.svg "$MFT (Master File Table)")

![alt text](https://cdn.rawgit.com/Invoke-IR/ForensicPosters/master/src/NTFS/MFT_Attributes/0x10-%24STANDARD_INFORMATION.svg "$STANDARD_INFORMATION Attribute")

![alt text](https://cdn.rawgit.com/Invoke-IR/ForensicPosters/master/src/NTFS/MFT_Attributes/0x20-%24ATTRIBUTE_LIST.svg "$ATTRIBUTE_LIST Attribute")

![alt text](https://cdn.rawgit.com/Invoke-IR/ForensicPosters/master/src/NTFS/MFT_Attributes/0x30-%24FILE_NAME.svg "$FILE_NAME Attribute")

![alt text](https://cdn.rawgit.com/Invoke-IR/ForensicPosters/master/src/NTFS/MFT_Attributes/0x60-%24VOLUME_NAME.svg "$VOLUME_NAME Attribute")

![alt text](https://cdn.rawgit.com/Invoke-IR/ForensicPosters/master/src/NTFS/MFT_Attributes/0x70-%24VOLUME_INFORMATION.svg "$VOLUME_INFORMATION Attribute")

![alt text](https://cdn.rawgit.com/Invoke-IR/ForensicPosters/master/src/NTFS/MFT_Attributes/0x80-%24DATA.svg "$DATA Attribute")

![alt text](https://cdn.rawgit.com/Invoke-IR/ForensicPosters/master/src/NTFS/MFT_Attributes/0x90-%24INDEX_ROOT.svg "$INDEX_ROOT Attribute")

![alt text](https://cdn.rawgit.com/Invoke-IR/ForensicPosters/master/src/NTFS/MFT_Attributes/0xA0-%24INDEX_ALLOCATION.svg "$INDEX_ALLOCATION Attribute")

![alt text](https://cdn.rawgit.com/Invoke-IR/ForensicPosters/master/src/NTFS/MFT_Attributes/NonResident.svg "Non-Resident Attribute")

![alt text](https://cdn.rawgit.com/Invoke-IR/ForensicPosters/master/src/NTFS/%24AttrDef.svg "$AttrDef (Attribute Definition File)")

![alt text](https://cdn.rawgit.com/Invoke-IR/ForensicPosters/master/src/NTFS/%24UsnJrnl_%24Max.svg "$UsnJrnl $Max Data Stream")

![alt text](https://cdn.rawgit.com/Invoke-IR/ForensicPosters/master/src/NTFS/%24UsnJrnl_%24J.svg "UsnJrnl $J Data Stream")

![alt text](https://cdn.rawgit.com/Invoke-IR/ForensicPosters/master/src/WindowsRegistry/RegistryHeader.svg "Registry Header")

![alt text](https://cdn.rawgit.com/Invoke-IR/ForensicPosters/master/src/WindowsRegistry/NamedKey.svg "Registry Named Key")

![alt text](https://cdn.rawgit.com/Invoke-IR/ForensicPosters/master/src/WindowsRegistry/SecurityKey.svg "Registry Security Key")

![alt text](https://cdn.rawgit.com/Invoke-IR/ForensicPosters/master/src/WindowsRegistry/ValueKey.svg "Registry Value Key")

![alt text](https://cdn.rawgit.com/Invoke-IR/ForensicPosters/master/src/Artifacts/ScheduledJob.svg "Scheduled Job")

![alt text](https://github.com/Invoke-IR/Forensic-Posters/blob/master/Posters/Prefetch101.png?raw=true "Windows 8 Prefetch")