Daunting as it may seem, one of the most wonderful aspects of
Windows forensics is its complexity. One of the fascinating
aspects of digital forensics is how we often leverage
conventional operating system features to provide information
peripheral to their original design. One such feature is the
Windows NTFS Index Attribute, also known as the $I30 file.
Knowing how to parse $I30 attributes provides a fantastic means
to identify deleted files, including those that have been wiped
or overwritten. A Simple Description of Index Attributes Many
popular file systems such as FAT and Unix store directory
information as a simple flat file. Recognizing efficiency issues
with lookups within large flat files, NTFS employed B-tree
indexing for several of its building blocks, providing efficient
storage of large data sets and very fast lookups. As forensic
examiners, we can take advantage of the NTFS B-tree
implementation as another source to identify files that once
existed in a given directory.