Enumerating Disk Artifacts In Memory
Windows has a special file known as Master File Table (MFT) which is an index to all the files located on the system. All the entries in the MFT file are 1024 bytes long and contain metadata and other attributes about a file like $STANDARD_INFOMRATION, $DATA, etc. Most of this data is usually found in the single line of record and is called resident data but mostly since data in files are long enough to be not able to fit in memory, so they have to reside outside the record and are called non-resident....