http://computer-forensics.sans.org/blog SANS Computer Forensic Investigations and Incident Response Blog Thu, 20 Jun 2013 9:29:25 +0000 enhttp://computer-forensics.sans.org/blog/2011/09/20/ntfs-i30-index-attributes-evidence-of-deleted-and-overwritten-files/comment-page-1/#comment-14847MangardSun, 13 Jan 2013 00:09:06 +0000http://computer-forensics.sans.org/blog/2011/09/20/ntfs-i30-index-attributes-evidence-of-deleted-and-overwritten-files/comment-page-1/#comment-14381Chad TilburyWed, 15 Aug 2012 20:56:52 +0000http://computer-forensics.sans.org/blog/2011/09/20/ntfs-i30-index-attributes-evidence-of-deleted-and-overwritten-files/comment-page-1/#comment-14376ChrisWed, 15 Aug 2012 20:10:36 +0000http://computer-forensics.sans.org/blog/2011/09/20/ntfs-i30-index-attributes-evidence-of-deleted-and-overwritten-files/comment-page-1/#comment-14351Rob LeeFri, 10 Aug 2012 17:47:23 +0000http://computer-forensics.sans.org/blog/2011/09/20/ntfs-i30-index-attributes-evidence-of-deleted-and-overwritten-files/comment-page-1/#comment-14311Jetico Technical TeamFri, 03 Aug 2012 04:53:38 +0000http://computer-forensics.sans.org/blog/2011/09/20/ntfs-i30-index-attributes-evidence-of-deleted-and-overwritten-files/comment-page-1/#comment-13811Chad TilburySat, 14 Apr 2012 05:17:16 +0000http://computer-forensics.sans.org/blog/2011/09/20/ntfs-i30-index-attributes-evidence-of-deleted-and-overwritten-files/comment-page-1/#comment-13571John McCashTue, 06 Mar 2012 19:26:55 +0000http://computer-forensics.sans.org/blog/2011/09/20/ntfs-i30-index-attributes-evidence-of-deleted-and-overwritten-files/comment-page-1/#comment-13161Yogesh KhatriWed, 12 Oct 2011 06:35:16 +0000http://computer-forensics.sans.org/blog/2011/09/20/ntfs-i30-index-attributes-evidence-of-deleted-and-overwritten-files/comment-page-1/#comment-13106Chad TilburyMon, 03 Oct 2011 01:47:30 +0000http://computer-forensics.sans.org/blog/2011/09/20/ntfs-i30-index-attributes-evidence-of-deleted-and-overwritten-files/comment-page-1/#comment-13101Chris TaylorSun, 02 Oct 2011 17:16:04 +0000