Delete date / Entry...
 
Notifications
Clear all

Delete date / Entry Modified in Recycle bin files  

  RSS
research1
(@research1)
Active Member

I have a .jpg image, which has a Entry modified date 3 months after the deletion date, on Encase. This file currently resides in the recycle bin.

Why would this be? I don't see how Entry modified can be updated, if the file was deleted previously.

Thanks in advance.

—–Addition, I forgot to mention - OS is vista.

Quote
Posted : 25/01/2011 8:10 pm
jhup
 jhup
(@jhup)
Community Legend

Would you please elucidate a wee bit more?

What modified "Entry" date are you referring to?

What is the source of the deletion date are you comparing it to?

Most things are possible, the question is the probability.

ReplyQuote
Posted : 25/01/2011 8:40 pm
research1
(@research1)
Active Member

What modified "Entry" date are you referring to?
'Entry Modified' field, in Encase.

What is the source of the deletion date are you comparing it to?
'File Deleted' field in Encase.

ReplyQuote
Posted : 25/01/2011 8:44 pm
jonstewart
(@jonstewart)
Junior Member

What modified "Entry" date are you referring to?
'Entry Modified' field, in Encase.

What is the source of the deletion date are you comparing it to?
'File Deleted' field in Encase.

In EnCase, on an NTFS volume, "Entry Modified" refers to the time that the MFT entry for the file was modified, i.e., the last time any metadata changed. The "Last Written" timestamp tells you the last time that the file contents changed.

Jon

ReplyQuote
Posted : 26/01/2011 4:58 am
LarryD
(@larryd)
New Member

The deleted date is the date the item was placed in the recycled bin. it is possible that the last MFT modified is when the bnin was emptied (assuming the file you are dealing with is deleted).

ReplyQuote
Posted : 26/01/2011 6:16 pm
Share: