MAC times

From ForensicsWiki
Revision as of 20:23, 5 October 2008 by .FUF (Talk | contribs)

Jump to: navigation, search

MAC times are timestamps of the latest modification, access or change of a certain file.

Disabling Last Access Time Stamp


Set the registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\FileSystem\NtfsDisableLastAccessUpdate to 1.

This setting is default under Windows Vista.


Mount file system with noatime option.


See Also

External Links