FTK 3.4 and Unix Fi...
 
Notifications
Clear all

FTK 3.4 and Unix Filesystem

1 Posts
1 Users
0 Reactions
502 Views
(@wmatson)
Active Member
Joined: 16 years ago
Posts: 8
Topic starter  

Hi All,

Forensicating a Unix system at the moment. Using FTK 3.4 – it displays the following time stamp columns Created, Accessed, Modified. I know there is no Created time stamp for Unix – instead there should be an Inode Changed. I know how to add different column settings, however there are only Unix security feature settings – no time stamp options. Are there additional "plugins" I can download or is Created actually = Inode Changed??

Any documentation on this would be above, beyond and appreciated.

Thanks


   
Quote
Share: