Notifications
Clear all

can i prove that?

11 Posts
7 Users
0 Reactions
1,243 Views
(@dcowen)
New Member
Joined: 16 years ago
Posts: 4
 

i have txt file in drive d
can i prove that it hasnn't been copied from drive c ?
through $logfile
thanks

in other words how can i access $logfile of that text file?
thanks in advance

A $logfile question!

Hi there! Questions for you

1. What version of Windows is the computer you are analyzing
2. Is the 'D' Drive also NTFS?
3. How long between the creation date of the file on the D drive and the creation of the forensic image was the computer active?


   
ReplyQuote
Page 2 / 2
Share: