File System

Shows files and folders excluded from VSS or backups with exclusion type, path, owner, and registry timestamp.

Shows files collected by ORC GetThis with paths, NTFS identifiers, sizes, hashes, timestamps, and match reasons.

Shows NTFS directory-index entries with paths, record identifiers, timestamps, sizes, attributes, and carving status.

Shows connected mass-storage devices with USB identifiers, serials, volume names, drive letters, users, and timestamps.

Provides the complete text of a multiline artefact as one normalized record for downstream analysis.

Shows MFT file records with paths, NTFS identifiers, timestamps, attributes, hashes, and executable metadata.

Shows file rename or deletion operations queued for reboot with source and target paths plus registry metadata.

Shows Recycle Bin entries with original paths, deletion times, sizes, and format headers.

Shows folders browsed in Explorer with reconstructed paths, item metadata, timestamps, users, and registry provenance.

Shows Windows Server SRUM physical-disk sizes with application, user, and timestamp context.

Shows Windows Server SRUM storage-volume capacity and usage with application, user, and timestamp context.

Shows USN Journal file changes with paths, NTFS identifiers, timestamps, reasons, attributes, and source snapshots.

Shows Windows volumes with identifiers, mount points, types, locations, shadow-copy IDs, and collected artefact sets.

Shows Volume Shadow Copy snapshots with snapshot IDs, source volumes, device paths, creation times, and attributes.