NTFS is a Transactional File System

What does it mean? It means every I/O operation is a transaction. And these transactions are performed atomically. Either they succeed or they fail. There are no half/partial writes (in theory).

Do you feel ntfs is reliable? Or do you prefer something more proven in the #raid world such as zfs?

Higher reliability of filesystems means higher probability of recovering deleted files during an investigation.

Bonus
This doesn’t mean you can’t find ways to subvert it. 👀 ➡️➡️➡️ alternate data streams