This information is covered in introductory courses on Windows/NTFS forensics, but I often lose track of the original source for technical information that I can cite in expert reports and other deliverables. Also, Iβm not a fan of citing proprietary training materials that canβt be easily found on the web, purchased from Amazon, or found in a public library.