folder and file acc...
Clear all

folder and file access forensic

2 Posts
2 Users
0 Reactions
Posts: 37
Eminent Member
Topic starter

I'm using Encase, the evidence file got two folder: important and secret, i want to find out the user account access these two folder from 2020 Nov.1---2020.Nov.20. and what are subfolders and files that user access, is it possible to be done in encase?

Posted : 18/05/2021 3:02 pm
Topic Tags
Posts: 59
Trusted Member

Each time that you open a file from Windows Explorer or from a standard open/save dialog-box, the name of the file that you opened is recorded by the (Windows) operating system. Some of the names are saved into the 'Recent' folder. Other are saved into the Registry. Use "RecentFilesView" from Nirsoft. Only the opening is recorded, so if you only access these folders without opening any files, there will be no registration...

Posted : 30/05/2021 6:45 pm