This is an excellent article the shows how to use low-level knowledge of NTFS to do cool work! https://twitter.com/0x6d616e69/status/840235262147981312