Notifications
Clear all
General (Technical, Procedural, Software, Hardware etc.)
2
Posts
2
Users
0
Reactions
320
Views
Topic starter
03/08/2008 7:18 pm
For a FAT file system, I'm trying to determine the deleted date or time for a directory.
I know FAT stores MAC times, but is there a way to find out a deleted time for a directory? Thanks!
05/08/2008 8:33 pm
The deleted time is only stored in the INFO file on a Windows system. This file is erased when the recycle bin is emptied but you can find fragments of it in unallocated space. There will be no INFO entry if the file was not deleted by placing it in the recycle bin, or if Norton systemworks was installed and the "nprotect" bin used. You can look to other clues of when the files were deleted. Obviously system time stamps will not have been changed after the file is deleted.