Examples

Worked, end-to-end forensic walkthroughs.

Goal: Read every field of a ReFS Volume Boot Record straight out of a raw hexdump -- no parser -- and derive cluster size, container size, version, and checksum mode, then confirm the by-hand values against the tool.

Identify a Native vs Upgraded ReFS Volume

Goal: Decide whether a v3.14 ReFS volume was freshly formatted under Win11 24H2 or upgraded from an older v3.4 volume. Both report version 3.14, so the answer comes from the checkpoint flags and the immutable VBR…

Worked Example: Detecting a Back-Dated (Timestomped) File

Goal: take a ReFS image, find the files whose creation time was forged into the past, and prove the tampering with an independent anchor rather than a single suspicious timestamp.

Worked Example: Enumerate Every Name of One Physical File (a Hard-Link Group)

Goal: given a ReFS image, recover the complete list of names that point at one physical file — and prove the reconstruction is correct by decoding the on-disk identity fields by hand, because ReFS stores no explicit…

Worked Example: Recover a Deleted File from a ReFS Image

Goal: run every available ReFS deletion-recovery method against one real image and read the results honestly — which method finds what, and why the others come up empty.

Worked Example: Recover Credentials, Alternate Streams and Earlier File Versions

Goal: one volume, three questions an investigator actually asks — where are the credentials, including the ones someone tried to hide?, what is in the alternate data streams?, and what did this file say before it was…

Worked Example: Track One File Across a Rename and a Move

Goal: show that a ReFS file's identity — its FileRef (HomeOid, FileId) — stays fixed while its name and directory change, and use that fixed identity to (a) follow the file through the change journal and (b) recognise…