RE: Win2K NTFS Change Journal

From: Mark E. Donaldson <markee(at)ridgecrest.ca.us>
Date: Mon Mar 17 2003 - 23:08:30 EST

Microsoft has a free WMI Utility called "Scriptomatic". I believe it has a module which will do this. I have a copy but do not have the exact URL I got it at. Search Microsoft for "Scriptomatic" and hopefully it will point you to it.

-----Original Message-----

From: Harlan Carvey [mailto:keydet89@yahoo.com] Sent: Friday, March 14, 2003 11:09 AM
To: forensics@securityfocus.com
Subject: Win2K NTFS Change Journal

I'm looking for an app that allows the user to enumerate the NTFS change journal on a live Win2K system.

Does anyone know of anything?

---

---

Harlan Carvey
Computer Security Administrator
AIM: carvdawg
Yahoo: keydet89

---

---

Do you Yahoo!?
Yahoo! Web Hosting - establish your business online http://webhosting.yahoo.com

---

This list is provided by the SecurityFocus ARIS analyzer service. For more information on this free incident handling, management and tracking system please see: http://aris.securityfocus.com

---

This list is provided by the SecurityFocus ARIS analyzer service. For more information on this free incident handling, management and tracking system please see: http://aris.securityfocus.com Received on Mon Mar 17 23:23:10 2003