MAC times

From Forensics Wiki
Revision as of 15:23, 5 October 2008 by .FUF (Talk | contribs)

Jump to: navigation, search

MAC times are timestamps of the latest modification, access or change of a certain file.

Contents

Disabling Last Access Time Stamp

Windows

Set the registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\FileSystem\NtfsDisableLastAccessUpdate to 1.

This setting is default under Windows Vista.

Linux

Mount file system with noatime option.

Example

See Also

External Links

Retrieved from "http://www.forensicswiki.org/w/index.php?title=MAC_times&oldid=2921"