Home Intel Hub T02 FireEye Threat Research Incident Response with NTFS INDX Buffers – Part 1: Extracting an INDX Attribute