Re: Creation / modification / access dates

From: Christine Siedsma <csiedsma(at)utica.edu>
Date: Tue Jul 15 2003 - 17:01:34 EDT

I'm not sure which may have been in PC Mag, but here are a few others that may be worth checking out:

http://patriot.net/~carvdawg/perl.html
See touch.pl

http://pascal.sources.ru/files/stampr11.htmhttp://www.vb-helper.com/howto_touch.htmlhttp://www.thescarms.com/VBasic/filetime.asphttp://www.codeproject.com/file/TimeStamp.asp

Christine Siedsma
Program Manager
Computer Forensic R&D Center
Utica College of Syracuse University
Utica, New York
315-792-3708

• Original Message ----- From: "Gary Kessler" <kumquat@sover.net> To: "Robert Goto" <res1ozma@verizon.net> Cc: <forensics@securityfocus.com>; "Michael Edwards" <medwards@digital-legal.com> Sent: Monday, July 14, 2003 10:22 AM Subject: Re: Creation / modification / access dates

> Hi all.
of MAC times. It used to be free but I can't find it anymore. Anyone have a link or a copy?
>
> Thanks!
would
> >be the definitions contained in the Encase manual.
> >
> >As far as the creation date of a CDR goes one place to start would be the
> >volume serial number which you can see by running the 'vol' command from
a
> >prompt. This will help if you have a suspected date range to test for.
I
> >also remember there being a pretty extensive thread on cdfs structure on
> >this mailing list.
> >
> >As with just about any and all date time information though you have to
> >remember that computers don't really know what time it is on their own
and
> >that all date time information depends on the system date time settings.
> >
> >Robert Goto

---

This list is provided by the SecurityFocus ARIS analyzer service. For more information on this free incident handling, management and tracking system please see: http://aris.securityfocus.com Received on Tue Jul 15 17:57:04 2003