Going beneath NTFS: USN Journal, dfir_NTFS, and artefact-driven investigations

This is advanced stuff that nobody should be unaware of whether they use Windows or not.