folder and file acc...
 
Notifications
Clear all

folder and file access forensic

afsfr
(@afsfr)
Junior Member

I'm using Encase, the evidence file got two folder: important and secret, i want to find out the user account access these two folder from 2020 Nov.1---2020.Nov.20. and what are subfolders and files that user access, is it possible to be done in encase?

Quote
Topic starter Posted : 18/05/2021 3:02 pm
Topic Tags
Thomas
(@thomas)
Member

Each time that you open a file from Windows Explorer or from a standard open/save dialog-box, the name of the file that you opened is recorded by the (Windows) operating system. Some of the names are saved into the 'Recent' folder. Other are saved into the Registry. Use "RecentFilesView" from Nirsoft. Only the opening is recorded, so if you only access these folders without opening any files, there will be no registration...

ReplyQuote
Posted : 30/05/2021 6:45 pm
Share: