https://github.com/Invoke-IR/ForensicPosters
- Invoke-IR/ForensicPosters GPT;
- Invoke-IR/ForensicPosters $UsnJrnl_$J;
- Invoke-IR/ForensicPosters Registry_NamedKey;
- Invoke-IR/ForensicPosters $UsnJrnl_$Max;
- Invoke-IR/ForensicPosters Registry_Header;
- Invoke-IR/ForensicPosters 0_MFT;
- Invoke-IR/ForensicPosters Prefetch101;
- Invoke-IR/ForensicPosters 0x10_$STANDARD_INFORMATION;
- Invoke-IR/ForensicPosters 7_$Boot(VBR);
- Invoke-IR/ForensicPosters 4_$AttrDef;
- Invoke-IR/ForensicPosters 0x20_$ATTRIBUTE_LIST;
- Invoke-IR/ForensicPosters 0xXX_NonResident;
- Invoke-IR/ForensicPosters 0x30_$FILE_NAME;
- Invoke-IR/ForensicPosters _MBR;
- Invoke-IR/ForensicPosters 0x60_$VOLUME_NAME;
- Invoke-IR/ForensicPosters 0xA0_$INDEX_ALLOCATION;
- Invoke-IR/ForensicPosters 0x70_$VOLUME_INFORMATION;
- The Windows PowerShell Logging Cheat Sheet;
- Invoke-IR/ForensicPosters 0x80_$DATA;
- Invoke-IR/ForensicPosters 0x90_$INDEX_ROOT;