O'Reilly logo

Windows Forensics and Incident Recovery by Harlan Carvey

Stay ahead with the world's most comprehensive technology and business learning platform.

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, tutorials, and more.

Start Free Trial

No credit card required

File Times

When an investigator or forensic analyst wants to develop a timeline of activity on a system, one of the most useful pieces of information is file times. Files on a live system have three file times associated with them; the last time the file was modified, the last time the file was accessed, and the date and time the file was created. Collectively, these file times are referred to as “MAC times.” These times are usually modified by applications, based on user's actions. For example, when a text file is opened in Notepad, the last access time is modified. If the user makes any changes to the file, the last modification time will be updated.

File times can be viewed by using the dir command with the appropriate switches. The /T switch, ...

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, interactive tutorials, and more.

Start Free Trial

No credit card required