Anthropic-Cybersecurity-Skills/skills/analyzing-mft-for-deleted-file-recovery/assets/template.md

MFT Deleted File Recovery Report Template

Case Information

Field	Value
Case Number
Examiner
Date
Evidence Source
MFT Hash (SHA-256)

Summary Statistics

Metric	Count
Total MFT Records
Active Records
Deleted Records
Timestomped Records

Deleted Files of Interest

Entry #	Filename	Original Path	Size	Created	Modified

Timestomping Indicators

Entry #	Filename	$SI Created	$FN Created	Delta

Conclusion

(Summary of deleted file recovery findings)