I just completed a physical dump on an HTC One V using Cellebrite UFED Touch. While going through the images stored in the /Android/data/com.cooliris.media/cache/ folder I noticed the Last Accessed time was way off from the Created/Modified times, 9 hours off. The last access time shows the same date but the time shows 1200AM. Is it possible that the Last Access time is not updated, only the date?
Thanks
I suspect that the file system is FAT which doesn't store a last accessed time, just the dates. Some applications will decode a missing time as 0 seconds past midnight…
Thanks Paul,
Absolutely, I got so wrapped up in the Android side of the equation, I completely forgot the image had been saved to the SD card, FAT system. Thanks again.
Les
If you are looking at data within an image then the date and time capabilities of the SD card won't be relevant. If you have extracted individual files to the SD card then they will be.
I have a similar question/issue. I processed an android phone with a micro sd with FTK and located pictures of value in the folder; com.cooliris.media/cache/hires-image-cache-xxxxx_512.cache on the micro sd. No pics stored on the phone's internal memory.
I understand fat doesn't update the last accessed time, but my dates are off, not the same day. The original pictures have been deleted and i tried to recover them from the micro sd, but for some reason are not showing. The "last accessed" date is way off from the date created/modified.
an example would be
Access date 8-29-14
Date created 9-18-14 114303 AM
Date modified 9-18-14 114302 AM
I have a suspicion but I am not sure and i suspect this will be asked in later in court (homicide case). Trying to determine or drill down when the victim was alive.
Thanks
Harry
I understand fat doesn't update the last accessed time
Says who?
Terry