The Deleted File That Wasn't
A workstation is suspected of staging data for exfiltration. You image the live disk of a Windows 10 machine. The user claims a folder C:\Users\jsmith\Projects\Q3 never existed. $MFT shows an entry for Q3 with the in-use flag cleared, created 11 days ago, modified 9 days ago. $UsnJrnl contains records for the folder and for 214 files under it, with a delete record 9 days ago. $LogFile has been overwritten. The disk is 512 GB and only 60 GB is allocated; unallocated space has not yet been carved. The machine was powered on when imaged. The user has admin rights.
1. Reconstruct what you can about the folder and assess how strongly each artefact supports the claim that it existed.
Read the worked answer
The evidence converges but each source has different weight.
$MFT: an entry with the in-use flag cleared is the record of a file or directory that was deleted but whose MFT record was not yet reused. It gives creation and modification timestamps. Strong, but timestamps can be manipulated by an admin, so treat them as reported values, not ground truth.
$UsnJrnl: the USN change journal records file operations as they happen and is not trivially edited. Records for the folder plus 214 child files, ending in a delete, are strong corroboration that the folder existed and held content. This is the backbone of the reconstruction.
$LogFile: overwritten, so no contribution. Its absence neither supports nor refutes.
Together: the folder almost certainly existed, was populated with roughly 214 files, and was deleted 9 days ago. The user's denial is contradicted by two independent artefacts. The judgement point is that you should not overstate: you can say the folder existed and when it was deleted, but not yet what the files contained until you carve unallocated space. Recommend carving and reviewing the 214 recovered files before drawing conclusions about what was staged.
2. The machine was live when imaged and the user has admin rights. What does each of those facts change about the reliability of your findings?
Read the worked answer
Live imaging means state was changing during acquisition. Files could be created, modified or deleted while the image was taken, so timestamps near the acquisition time are unreliable and the image is not a perfect point-in-time snapshot. It also means volatile data (running processes, network connections, RAM-resident artefacts) was available and should have been captured first; if it was not, that opportunity is lost. Note the acquisition window in the report so any timestamp inside it is treated with caution.
Admin rights mean the user could have cleared the USN journal, altered MFT timestamps, wiped $LogFile, or run anti-forensic tools. That does not make the artefacts you have worthless, but it shifts the burden: corroborate $MFT and $UsnJrnl against sources the user could not easily touch - server-side file shares, backup systems, EDR telemetry, email attachments, and network logs. The fact that $LogFile was overwritten while $UsnJrnl survived is itself worth noting; it may be normal rollover or may be selective tampering, and you should not assume either without checking log sizes and rotation behaviour.
The judgement: present findings with explicit confidence levels and state the anti-forensic possibility rather than asserting the user lied.