AbstractIntroductionMethodologyInitial ComparisonReFS MBRReFS VBRFSRSMACE TimesReFS Metadata BlockReFS MFTReFS Folder Naming ProcessDrive LabelsRecycle BinDesktop.ini FileSecurity IdentifierFolder Analysis.doc Analysis.txt Analysis.exe AnalysisReferencesAboutMisc Forensics

Forensic Investigation of Microsoft's Resilient File System (ReFS)

Having completed the forensic investigation of ReFS, there were a number of interesting points and things discovered, such as the File System Recognition Structure and the 16kb ReFS Metadata Block.

Hopefully this site will be able to show the information found and demonstrate how these conclusions were drawn.