MAC times

From Forensics Wiki

Revision as of 11:15, 24 November 2007 by Alex (Talk | contribs)

(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)

Jump to: navigation, search

MAC times are timestamps of the latest modification, access or change of a certain file. With Windows Vista, the registry key 'HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\FileSystem\NtfsDisableLastAccessUpdate' is set to '1' by default, which means that no last access timestamp will be written at all.

Example

External Links

Retrieved from "http://www.forensicswiki.org/w/index.php?title=MAC_times&oldid=2919"

Personal tools

Log in / create account

About forensicswiki.org:

Toolbox