ForensicsWiki will continue to operate as it has before and will not be shutting down. Thank you for your continued support of ForensicsWiki.

MAC times

From ForensicsWiki
Revision as of 20:23, 5 October 2008 by .FUF (Talk | contribs)

Jump to: navigation, search

MAC times are timestamps of the latest modification, access or change of a certain file.

Disabling Last Access Time Stamp


Set the registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\FileSystem\NtfsDisableLastAccessUpdate to 1.

This setting is default under Windows Vista.


Mount file system with noatime option.


See Also

External Links