Computer Forensics: Date for a File (in the MFT)
Update: 2009-05-31
Description
Files can have many dates, the first 4 dates for a file (in the MFT) are shown in this video. Looking at the $Standard_Information Attribute within the MFT.
The examination is conducted using EnCase. These dates are important for those conducting forensic examinations
The examination is conducted using EnCase. These dates are important for those conducting forensic examinations
Comments
In Channel