The first episode of DFIR in 120 seconds covers NTFS timestamps. They are frequently misinterpreted even by seasoned security professionals.
DFIR120 – NTFS Timestamps

The first episode of DFIR in 120 seconds covers NTFS timestamps. They are frequently misinterpreted even by seasoned security professionals.