puffyCid / artemis

A cross platform forensic parser written in Rust!
MIT License
64 stars 7 forks source link

Consider using UsnJrnl rewind logic #143

Open puffyCid opened 4 months ago

puffyCid commented 4 months ago

What new feature do you think would be cool to add to artemis? An interesting blog post was puslibhed recently, April 2024, that talked about an alternative approach to create the full paths in the UsnJrnl.

It might be worth trying to implement this for artemis, if possible

Describe the solution you'd like Consider using UsnJrnl rewind logic to recreate the full path for the UsnJrnl

Additional context

https://cybercx.com.au/blog/ntfs-usnjrnl-rewind/