ForensicsWiki will continue to operate as it has before and will not be shutting down. Thank you for your continued support of ForensicsWiki.

MAC times

From ForensicsWiki
Revision as of 16:15, 24 November 2007 by Alex (Talk | contribs)

Jump to: navigation, search

MAC times are timestamps of the latest modification, access or change of a certain file. With Windows Vista, the registry key 'HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\FileSystem\NtfsDisableLastAccessUpdate' is set to '1' by default, which means that no last access timestamp will be written at all.


External Links