folder and file acc...
 
Notifications
Clear all

folder and file access forensic

2 Posts
2 Users
0 Likes
1,486 Views
afsfr
(@afsfr)
Posts: 37
Eminent Member
Topic starter
 

I'm using Encase, the evidence file got two folder: important and secret, i want to find out the user account access these two folder from 2020 Nov.1---2020.Nov.20. and what are subfolders and files that user access, is it possible to be done in encase?

 
Posted : 18/05/2021 3:02 pm
Topic Tags
Thomas
(@thomas)
Posts: 59
Trusted Member
 

Each time that you open a file from Windows Explorer or from a standard open/save dialog-box, the name of the file that you opened is recorded by the (Windows) operating system. Some of the names are saved into the 'Recent' folder. Other are saved into the Registry. Use "RecentFilesView" from Nirsoft. Only the opening is recorded, so if you only access these folders without opening any files, there will be no registration...

 
Posted : 30/05/2021 6:45 pm
Share:
Share to...