Difference between revisions of "MAC times"

From Forensics Wiki
Jump to: navigation, search
m
m
Line 1: Line 1:
 
'''MAC times''' are timestamps of the latest ''modification'', ''access'' or ''change'' of a certain file.
 
'''MAC times''' are timestamps of the latest ''modification'', ''access'' or ''change'' of a certain file.
 +
With Windows Vista, the registry key 'HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\FileSystem\NtfsDisableLastAccessUpdate' is set to '1' by default, which means that no last access timestamp will be written at all.
  
 
== Example ==
 
== Example ==

Revision as of 11:15, 24 November 2007

MAC times are timestamps of the latest modification, access or change of a certain file. With Windows Vista, the registry key 'HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\FileSystem\NtfsDisableLastAccessUpdate' is set to '1' by default, which means that no last access timestamp will be written at all.

Example

External Links