Computer Forensics: Date for a File (in the MFT)

Files can have many dates, the first 4 dates for a file (in the MFT) are shown in this video. Looking at the $Standard_Information Attribute within the MFT.

The examination is conducted using EnCase. These dates are important for those conducting forensic examinations

Category:

Science & Technology

Tags:

• MFT
• EnCase
• Dates
• File Dates
• Computer
• Forensics

[ALUMINUM20]

That was very interesting. Thanks a lot. Keep the videos coming!!! :)

[whereisyourdata]

Thanks - another one has just gone up

[authmaax]

VSS storage

and deframentation tools coverage

will be very apreciated

the best defrag tools still seem to be dumb not considering what the OS does it self.