if you’re examining a forensic ntfs image from a windows 7 or older system, you’ll see two attribute ____: one for the short filename and one for the long filename.