Initial Commit

infosecCLI · Jul 7, 2015 · 4d08d87 · 4d08d87
1 parent 7f8af92
commit 4d08d87
Showing 1 changed file with 15 additions and 0 deletions.
diff --git a/README.md b/README.md
@@ -0,0 +1,15 @@
+![alt text](https://github.com/Invoke-IR/Forensic-Posters/blob/master/1_Boot%20Sector/1A_Master%20Boot%20Record/MBR.png?raw=true "Master Boot Record")
+
+![alt text](https://github.com/Invoke-IR/Forensic-Posters/blob/master/1_Boot%20Sector/1B_Guid%20Partition%20Table/GPT.png?raw=true "Guid Partition Table")
+
+![alt text](https://github.com/Invoke-IR/Forensic-Posters/blob/master/2_Volume%20Boot%20Record%20($Boot)/VBR.png?raw=true "NTFS Volume Boot Record")
+
+![alt text](https://github.com/Invoke-IR/Forensic-Posters/blob/master/3_Master%20File%20Table%20Record/MFT.png?raw=true "Master File Table")
+
+![alt text](https://github.com/Invoke-IR/Forensic-Posters/blob/master/4_MFT%20Attributes/0x10_$STANDARD_INFORMATION/$STANDARD_INFORMATION.png?raw=true "$STANDARD_INFORMATION Attribute")
+
+![alt text](https://github.com/Invoke-IR/Forensic-Posters/blob/master/4_MFT%20Attributes/0x30_$FILE_NAME/$FILE_NAME.png?raw=true "$FILE_NAME Attribute")
+
+![alt text](https://github.com/Invoke-IR/Forensic-Posters/blob/master/Artifacts/UsnJrnl/$UsnJrnl_$J.png?raw=true "UsnJrnl $J Data Stream")
+
+![alt text](https://github.com/Invoke-IR/Forensic-Posters/blob/master/Artifacts/Prefetch/Prefetch101.png?raw=true "Windows 8 Prefetch")