±Forensic Focus Partners

Become an advertising partner

±Your Account


Forgotten password/username?

Site Members:

New Today: 4 Overall: 36205
New Yesterday: 1 Visitors: 131

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Videos

±Latest Jobs

penulatimate date

Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
Page Previous  1, 2 

Senior Member

Re: penulatimate date

Post Posted: Oct 18, 19 19:20

- keydet89
- jaclaz

It seems to me like that might (maybe) provide "other" or "previous" times the file was opened, but no actual way to be sure that it was the penultimate time.

Again, it's possible...not definitive. So...maybe.

Sorry, but I am a hairy reasoner, if you can I would like a more definite answer.

IMHO by analyzing a system:
1) you may (or you may not) find some evidence about a given file having been opened/accessed before a given date/time
2) IF you find such evidence this may consist of either
a. a single previous access
b. more than one previous access

in case 2.b you can order the (several) previous access date times and choose the most recent one (still before the given date/time), so you are in the same case of 2.a.

Now, what makes you able to state that that instance is actually the penultimate (and that is not the third or fourth or nth last one)?

As I see it there is a BIG IF in #2, after which there is an "impossible", it is even not a "maybe*maybe=maybe^2", it is a "maybe+impossible=impossible".

- In theory there is no difference between theory and practice, but in practice there is. - 

Senior Member

Re: penulatimate date

Post Posted: Oct 19, 19 07:49

I will try thanks keydet  

Page 2 of 2
Page Previous  1, 2