The goal of the thesis is to explore the possibilities of how digital forensics of NTFS-based file systems can be facilitated by the analysis of their metadata. The work will provide insight into how NTFS handles file metadata during common file manipulations. In order to simplify the forensics analysis of NTFS systems, the thesis will examine techniques to identify anomalies or suspicious patterns of file metadata. The methods will allow automated pre-processing of the initial dataset, helping reduce the overall analyst's involvement. The results will be integrated with the application Fimetis and made available to the end user as part of the CopAS framework.