Windows Time Rule for Digital Forensic

There are some common rules for windows time rule for $Standard_Information and $Filename. Here is the table for those common rules.

This below table (created by SANS) is the rule for MACB/E (Modified , Access, Create/Change, and Birth/Entry) timestamps.

Usually, $FILENAME information is hardly modified/timestomped. So this information can be useful for doing a forensic for Windows file.

0 0 vote
Article Rating


We are teams that have the same hobbies in Information Technologies and have experienced in many fields regarding Information Technologies .

Recent Articles

Subscribe
Notify of
guest
0 Comments
Inline Feedbacks
View all comments
3
0
Would love your thoughts, please comment.x
()
x