Let me throw a question out there for all you #DFIR. What would you use if all you had to go (initially) on was the file containing the MFT?