.. / fsutil.exe
Star

File System Utility


Paths:

Acknowledgements:

Detection:

Zero out a file
fsutil.exe file setZeroData offset=0 length=9999999999 C:\Windows\Temp\payload.dll
Usecase: Can be used to forensically erase a file
Privileges required: User
OS: Windows XP, Windows Vista, Windows 7, Windows 8, Windows 8.1, Windows 10
MITRE ATT&CK®: T1485



Delete the USN journal volume to hide file creation activity
fsutil.exe usn deletejournal /d c:
Usecase: Can be used to hide file creation activity
Privileges required: User
OS: Windows XP, Windows Vista, Windows 7, Windows 8, Windows 8.1, Windows 10
MITRE ATT&CK®: T1485