I am a newbie so please excuse this inquiry. When a floppy disk is formatted, is there a way to find out the approximate time it was formatted? What tool do you prefer using when carving data from a physical drive? Any info is appreciated.
Hallo
Yes, the answer to your questions is it may be possible.
Craig Wilson from Digital Detective has written a good paper on this which explains how you may possibly do this
http//
He explains that it depends on which operating system was asked to format the disk.
There are so many tools for carving data from a drive. It depends on what you are trying to carve. What are you looking for and what is your primary forensic tool?
Yes, the answer to your questions is it may be possible.
No I am afraid that answer is that it is not possible - or rather highly unlikely.
Becuase of the way that the serial number, referred to in Craigs document, is created - to determine the date your would need to know the time and to determine the time you would need to know the date.
Hallo Paul
I was actually referring to the second method described by Craig where he recovers the format date from the directory entry of the volume label. This can then be used to check the accuracy of the serial number.
So assuming the volume label has not been updated since format it still may be possible to identify when the floppy was formatted.
Thank you guys for the responses. They were very helpful.