diff --git a/README.md b/README.md deleted file mode 100644 index 78b578f..0000000 --- a/README.md +++ /dev/null @@ -1,29 +0,0 @@ -![alt text](https://github.com/Invoke-IR/Forensic-Posters/blob/master/_Boot%20Sector/1A_Master%20Boot%20Record/MBR.png?raw=true "Master Boot Record") - -![alt text](https://github.com/Invoke-IR/Forensic-Posters/blob/master/_Boot%20Sector/1B_Guid%20Partition%20Table/GPT.png?raw=true "Guid Partition Table") - -![alt text](https://github.com/Invoke-IR/Forensic-Posters/blob/master/7_$Boot%20(Volume%20Boot%20Record)/VBR.png?raw=true "NTFS Volume Boot Record") - -![alt text](https://github.com/Invoke-IR/Forensic-Posters/blob/master/0_Master%20File%20Table%20Record/MFT.png?raw=true "Master File Table") - -![alt text](https://github.com/Invoke-IR/Forensic-Posters/blob/master/0_Master%20File%20Table%20Record/MFT%20Attributes/0x10_$STANDARD_INFORMATION/$STANDARD_INFORMATION.png?raw=true "$STANDARD_INFORMATION Attribute") - -![alt text](https://github.com/Invoke-IR/Forensic-Posters/blob/master/0_Master%20File%20Table%20Record/MFT%20Attributes/0x30_$FILE_NAME/$FILE_NAME.png?raw=true "$FILE_NAME Attribute") - -![alt text](https://github.com/Invoke-IR/Forensic-Posters/blob/master/0_Master%20File%20Table%20Record/MFT%20Attributes/0x60_$VOLUME_NAME/$VOLUME_NAME.png?raw=true "$VOLUME_NAME Attribute") - -![alt text](https://github.com/Invoke-IR/Forensic-Posters/blob/master/0_Master%20File%20Table%20Record/MFT%20Attributes/0x70_$VOLUME_INFORMATION/$VOLUME_INFORMATION.png?raw=true "$VOLUME_INFORMATION Attribute") - -![alt text](https://github.com/Invoke-IR/Forensic-Posters/blob/master/0_Master%20File%20Table%20Record/MFT%20Attributes/0x80_$DATA/$DATA.png?raw=true "$DATA Attribute") - -![alt text](https://github.com/Invoke-IR/Forensic-Posters/blob/master/0_Master%20File%20Table%20Record/MFT%20Attributes/0x90_$INDEX_ROOT/$INDEX_ROOT.png?raw=true "$INDEX_ROOT Attribute") - -![alt text](https://github.com/Invoke-IR/Forensic-Posters/blob/master/0_Master%20File%20Table%20Record/MFT%20Attributes/0xA0_$INDEX_ALLOCATION/$INDEX_ALLOCATION.png?raw=true "$INDEX_ALLOCATION Attribute") - -![alt text](https://github.com/Invoke-IR/Forensic-Posters/blob/master/0_Master%20File%20Table%20Record/MFT%20Attributes/_NonResident/NonResident.png?raw=true "Non-Resident Attribute") - -![alt text](https://github.com/Invoke-IR/Forensic-Posters/blob/master/11_$Extend/$UsnJrnl/$UsnJrnl_$Max.png?raw=true "UsnJrnl $J Data Stream") - -![alt text](https://github.com/Invoke-IR/Forensic-Posters/blob/master/11_$Extend/$UsnJrnl/$UsnJrnl_$J.png?raw=true "UsnJrnl $J Data Stream") - -![alt text](https://github.com/Invoke-IR/Forensic-Posters/blob/master/Artifacts/Prefetch/Prefetch101.png?raw=true "Windows 8 Prefetch")