THE IMPACT OF MICROSOFT'S REFS ON DFIR

Summary from the TLDR InfoSec newsletter

This blog post provides an in-depth discussion of the new Microsoft Resilient File System (ReFS) and details how it differs from NTFS from a forensics perspective. It highlights the challenges during the transitional period, such as a gap in tooling maturity, no Master File Table, a lack of undo logs in ReFS' logging, changes in the Change Journal, and various removed NTFS features. However, ReFS also offers new forensics opportunities, including the ReFS Log and “First Events,” the potential for carving opportunities in superblocks and checkpoints, the potential for deleted data to persist if shared with another file, integrity streams traces, and other metadata.