MAC times

From ForensicsWiki
Revision as of 16:23, 5 October 2008 by .FUF (Talk | contribs)

Jump to: navigation, search

MAC times are timestamps of the latest modification, access or change of a certain file.

Disabling Last Access Time Stamp

Windows

Set the registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\FileSystem\NtfsDisableLastAccessUpdate to 1.

This setting is default under Windows Vista.

Linux

Mount file system with noatime option.

Example

See Also

External Links