Modifying timestamp...
 
Notifications
Clear all

Modifying timestamps of deleted files in the MFT

11 Posts
6 Users
0 Reactions
2,912 Views
neddy
(@neddy)
Estimable Member
Joined: 21 years ago
Posts: 182
 

If this is a theoretical question, the answer is yes. If this relates to an inquiry where someone claims that the date and time stamps have been altered, one has to ask why do this when it would be easier to delete the records entirely. In theory it can be done but as suggested in prior comments it is likely that it could be proven that this was the case and other artefacts need to be considered.


   
ReplyQuote
Page 2 / 2
Share: