I have a .jpg image, which has a Entry modified date 3 months after the deletion date, on Encase. This file currently resides in the recycle bin.
Why would this be? I don't see how Entry modified can be updated, if the file was deleted previously.
Thanks in advance.
—–Addition, I forgot to mention - OS is vista.
Would you please elucidate a wee bit more?
What modified "Entry" date are you referring to?
What is the source of the deletion date are you comparing it to?
Most things are possible, the question is the probability.
What modified "Entry" date are you referring to?
'Entry Modified' field, in Encase.
What is the source of the deletion date are you comparing it to?
'File Deleted' field in Encase.
What modified "Entry" date are you referring to?
'Entry Modified' field, in Encase.What is the source of the deletion date are you comparing it to?
'File Deleted' field in Encase.
In EnCase, on an NTFS volume, "Entry Modified" refers to the time that the MFT entry for the file was modified, i.e., the last time any metadata changed. The "Last Written" timestamp tells you the last time that the file contents changed.
Jon
The deleted date is the date the item was placed in the recycled bin. it is possible that the last MFT modified is when the bnin was emptied (assuming the file you are dealing with is deleted).