...
Recovering Zone.Identifier Alternate Data Streams
With the this release of HstEx®, we have added the ability to search and recover MFT entries containing resident Zone.Identifier dataAlternate Data Streams. This provides us with a lot of information regarding the original file and is a good source of
. The recovered data is easily read into NetAnalysis® for examination. The image below shows a number of recovered Zone Identifier entries. The Information panel shows the associated MFT attribute information along with the Zone Transfer data from the Zone.Identifier stream.
...