http://www.forensicswiki.org/w/index.php?title=Talk:Timestomp&feed=atom&action=history 2013-06-19T10:54:21Z Revision history for this page on the wiki MediaWiki 1.21.1 http://www.forensicswiki.org/w/index.php?title=Talk:Timestomp&diff=7806&oldid=prev 2012-02-05T16:35:48Z

<p></p> <table class='diff diff-contentalign-left'> <col class='diff-marker' /> <col class='diff-content' /> <col class='diff-marker' /> <col class='diff-content' /> <tr style='vertical-align: top;'> <td colspan='2' style="background-color: white; color:black; text-align: center;">← Older revision</td> <td colspan='2' style="background-color: white; color:black; text-align: center;">Revision as of 16:35, 5 February 2012</td> </tr><tr><td colspan="2" class="diff-lineno">Line 1:</td> <td colspan="2" class="diff-lineno">Line 1:</td></tr> <tr><td class='diff-marker'>−</td><td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #ffe49c; vertical-align: top; white-space: pre-wrap;"><div><del style="font-weight: bold; text-decoration: none;">This article references &quot;MACE&quot; values which I've never heard of. Now, humbly, that doesn't mean a whole lot ;) but I was curious if the author of this page meant to write MAC values instead. Thoughts? [[User:Cobalt2020|AEI Forensics]]</del></div></td><td colspan="2">&#160;</td></tr> <tr><td class='diff-marker'>−</td><td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #ffe49c; vertical-align: top; white-space: pre-wrap;"><div><del style="font-weight: bold; text-decoration: none;">: I'm a n00b ;)&#160; I just remembered what the E stands for (the Master File Table Entry Modified time stamp of the file).&#160; Do we have a page on here for a proper explanation of the MACE acronym? [[User:Cobalt2020|AEI Forensics]]</del></div></td><td colspan="2">&#160;</td></tr> <tr><td class='diff-marker'>−</td><td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #ffe49c; vertical-align: top; white-space: pre-wrap;"><div><del style="font-weight: bold; text-decoration: none;">:: We don't have an article on timestamps per se, but I think it would make a great addition to the [[NTFS]] page. Can you help us write it? I've made start. [[User:Jessek|Jessek]]</del></div></td><td colspan="2">&#160;</td></tr> <tr><td class='diff-marker'>−</td><td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #ffe49c; vertical-align: top; white-space: pre-wrap;"><div><del style="font-weight: bold; text-decoration: none;"></del></div></td><td colspan="2">&#160;</td></tr> <tr><td class='diff-marker'>&#160;</td><td style="background-color: #f9f9f9; color: #333333; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #e6e6e6; vertical-align: top; white-space: pre-wrap;"><div>== Delete Timestamps? ==</div></td><td class='diff-marker'>&#160;</td><td style="background-color: #f9f9f9; color: #333333; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #e6e6e6; vertical-align: top; white-space: pre-wrap;"><div>== Delete Timestamps? ==</div></td></tr> <tr><td class='diff-marker'>&#160;</td><td style="background-color: #f9f9f9; color: #333333; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #e6e6e6; vertical-align: top; white-space: pre-wrap;"></td><td class='diff-marker'>&#160;</td><td style="background-color: #f9f9f9; color: #333333; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #e6e6e6; vertical-align: top; white-space: pre-wrap;"></td></tr> </table>

Cobalt2020 http://www.forensicswiki.org/w/index.php?title=Talk:Timestomp&diff=7805&oldid=prev 2011-12-14T17:07:15Z

<p></p> <table class='diff diff-contentalign-left'> <col class='diff-marker' /> <col class='diff-content' /> <col class='diff-marker' /> <col class='diff-content' /> <tr style='vertical-align: top;'> <td colspan='2' style="background-color: white; color:black; text-align: center;">← Older revision</td> <td colspan='2' style="background-color: white; color:black; text-align: center;">Revision as of 17:07, 14 December 2011</td> </tr><tr><td colspan="2" class="diff-lineno">Line 2:</td> <td colspan="2" class="diff-lineno">Line 2:</td></tr> <tr><td class='diff-marker'>&#160;</td><td style="background-color: #f9f9f9; color: #333333; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #e6e6e6; vertical-align: top; white-space: pre-wrap;"><div>: I'm a n00b ;)&#160; I just remembered what the E stands for (the Master File Table Entry Modified time stamp of the file).&#160; Do we have a page on here for a proper explanation of the MACE acronym? [[User:Cobalt2020|AEI Forensics]]</div></td><td class='diff-marker'>&#160;</td><td style="background-color: #f9f9f9; color: #333333; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #e6e6e6; vertical-align: top; white-space: pre-wrap;"><div>: I'm a n00b ;)&#160; I just remembered what the E stands for (the Master File Table Entry Modified time stamp of the file).&#160; Do we have a page on here for a proper explanation of the MACE acronym? [[User:Cobalt2020|AEI Forensics]]</div></td></tr> <tr><td class='diff-marker'>&#160;</td><td style="background-color: #f9f9f9; color: #333333; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #e6e6e6; vertical-align: top; white-space: pre-wrap;"><div>:: We don't have an article on timestamps per se, but I think it would make a great addition to the [[NTFS]] page. Can you help us write it? I've made start. [[User:Jessek|Jessek]]</div></td><td class='diff-marker'>&#160;</td><td style="background-color: #f9f9f9; color: #333333; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #e6e6e6; vertical-align: top; white-space: pre-wrap;"><div>:: We don't have an article on timestamps per se, but I think it would make a great addition to the [[NTFS]] page. Can you help us write it? I've made start. [[User:Jessek|Jessek]]</div></td></tr> <tr><td colspan="2">&#160;</td><td class='diff-marker'>+</td><td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div><ins style="font-weight: bold; text-decoration: none;"></ins></div></td></tr> <tr><td colspan="2">&#160;</td><td class='diff-marker'>+</td><td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div><ins style="font-weight: bold; text-decoration: none;">== Delete Timestamps? ==</ins></div></td></tr> <tr><td colspan="2">&#160;</td><td class='diff-marker'>+</td><td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div><ins style="font-weight: bold; text-decoration: none;"></ins></div></td></tr> <tr><td colspan="2">&#160;</td><td class='diff-marker'>+</td><td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div><ins style="font-weight: bold; text-decoration: none;">The article text says something about TimeStomp being able to delete timestamps. That must surely be nonsense. </ins></div></td></tr> <tr><td colspan="2">&#160;</td><td class='diff-marker'>+</td><td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div><ins style="font-weight: bold; text-decoration: none;"></ins></div></td></tr> <tr><td colspan="2">&#160;</td><td class='diff-marker'>+</td><td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div><ins style="font-weight: bold; text-decoration: none;">A timestamp (FILETIME) is just a number from 0 up to some maximum.&#160; It can be overwritten, it can be zeroed out, but it cannot be deleted. The timestamp 0 or 1 is as valid as any other timestamp.</ins></div></td></tr> <tr><td colspan="2">&#160;</td><td class='diff-marker'>+</td><td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div><ins style="font-weight: bold; text-decoration: none;"></ins></div></td></tr> <tr><td colspan="2">&#160;</td><td class='diff-marker'>+</td><td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div><ins style="font-weight: bold; text-decoration: none;">There are some utility libraries that cannot convert such timestamps to 'strings', and instead produce something like 'Illegal time', or just an empty string, but that is due to bugs in that particular software, and should not be assumed to be anything else.[[User:Athulin|Athulin]] 09:07, 14 December 2011 (PST)</ins></div></td></tr> </table>

Athulin http://www.forensicswiki.org/w/index.php?title=Talk:Timestomp&diff=7804&oldid=prev 2007-10-25T14:03:22Z

<p></p> <table class='diff diff-contentalign-left'> <col class='diff-marker' /> <col class='diff-content' /> <col class='diff-marker' /> <col class='diff-content' /> <tr style='vertical-align: top;'> <td colspan='2' style="background-color: white; color:black; text-align: center;">← Older revision</td> <td colspan='2' style="background-color: white; color:black; text-align: center;">Revision as of 14:03, 25 October 2007</td> </tr><tr><td colspan="2" class="diff-lineno">Line 1:</td> <td colspan="2" class="diff-lineno">Line 1:</td></tr> <tr><td class='diff-marker'>&#160;</td><td style="background-color: #f9f9f9; color: #333333; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #e6e6e6; vertical-align: top; white-space: pre-wrap;"><div>This article references &quot;MACE&quot; values which I've never heard of. Now, humbly, that doesn't mean a whole lot ;) but I was curious if the author of this page meant to write MAC values instead. Thoughts? [[User:Cobalt2020|AEI Forensics]]</div></td><td class='diff-marker'>&#160;</td><td style="background-color: #f9f9f9; color: #333333; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #e6e6e6; vertical-align: top; white-space: pre-wrap;"><div>This article references &quot;MACE&quot; values which I've never heard of. Now, humbly, that doesn't mean a whole lot ;) but I was curious if the author of this page meant to write MAC values instead. Thoughts? [[User:Cobalt2020|AEI Forensics]]</div></td></tr> <tr><td class='diff-marker'>&#160;</td><td style="background-color: #f9f9f9; color: #333333; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #e6e6e6; vertical-align: top; white-space: pre-wrap;"><div>: I'm a n00b ;)&#160; I just remembered what the E stands for (the Master File Table Entry Modified time stamp of the file).&#160; Do we have a page on here for a proper explanation of the MACE acronym? [[User:Cobalt2020|AEI Forensics]]</div></td><td class='diff-marker'>&#160;</td><td style="background-color: #f9f9f9; color: #333333; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #e6e6e6; vertical-align: top; white-space: pre-wrap;"><div>: I'm a n00b ;)&#160; I just remembered what the E stands for (the Master File Table Entry Modified time stamp of the file).&#160; Do we have a page on here for a proper explanation of the MACE acronym? [[User:Cobalt2020|AEI Forensics]]</div></td></tr> <tr><td colspan="2">&#160;</td><td class='diff-marker'>+</td><td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div><ins style="font-weight: bold; text-decoration: none;">:: We don't have an article on timestamps per se, but I think it would make a great addition to the [[NTFS]] page. Can you help us write it? I've made start. [[User:Jessek|Jessek]]</ins></div></td></tr> </table>

Jessek http://www.forensicswiki.org/w/index.php?title=Talk:Timestomp&diff=7803&oldid=prev 2007-10-24T18:30:48Z

<p></p> <table class='diff diff-contentalign-left'> <col class='diff-marker' /> <col class='diff-content' /> <col class='diff-marker' /> <col class='diff-content' /> <tr style='vertical-align: top;'> <td colspan='2' style="background-color: white; color:black; text-align: center;">← Older revision</td> <td colspan='2' style="background-color: white; color:black; text-align: center;">Revision as of 18:30, 24 October 2007</td> </tr><tr><td colspan="2" class="diff-lineno">Line 1:</td> <td colspan="2" class="diff-lineno">Line 1:</td></tr> <tr><td class='diff-marker'>&#160;</td><td style="background-color: #f9f9f9; color: #333333; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #e6e6e6; vertical-align: top; white-space: pre-wrap;"><div>This article references &quot;MACE&quot; values which I've never heard of. Now, humbly, that doesn't mean a whole lot ;) but I was curious if the author of this page meant to write MAC values instead. Thoughts? [[User:Cobalt2020|AEI Forensics]]</div></td><td class='diff-marker'>&#160;</td><td style="background-color: #f9f9f9; color: #333333; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #e6e6e6; vertical-align: top; white-space: pre-wrap;"><div>This article references &quot;MACE&quot; values which I've never heard of. Now, humbly, that doesn't mean a whole lot ;) but I was curious if the author of this page meant to write MAC values instead. Thoughts? [[User:Cobalt2020|AEI Forensics]]</div></td></tr> <tr><td colspan="2">&#160;</td><td class='diff-marker'>+</td><td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div><ins style="font-weight: bold; text-decoration: none;">: I'm a n00b ;)&#160; I just remembered what the E stands for (the Master File Table Entry Modified time stamp of the file).&#160; Do we have a page on here for a proper explanation of the MACE acronym? [[User:Cobalt2020|AEI Forensics]]</ins></div></td></tr> </table>

Cobalt2020 http://www.forensicswiki.org/w/index.php?title=Talk:Timestomp&diff=7802&oldid=prev 2007-10-24T17:20:14Z

<p>New page: This article references &quot;MACE&quot; values which I&#039;ve never heard of. Now, humbly, that doesn&#039;t mean a whole lot ;) but I was curious if the author of this page meant to write MAC values instea...</p> <p><b>New page</b></p><div>This article references &quot;MACE&quot; values which I've never heard of. Now, humbly, that doesn't mean a whole lot ;) but I was curious if the author of this page meant to write MAC values instead. Thoughts? [[User:Cobalt2020|AEI Forensics]]</div>

Cobalt2020