Orphan file dates in FTK

General (Technical, Procedural, Software, Hardware etc.)

Last Post by djustice 5 years ago

1 Posts

1 Users

0 Reactions

2,393 Views

RSS

djustice

(@djustice)

New Member

Joined: 5 years ago

Posts: 1

Topic starter 13/10/2021 6:47 pm [#19263]

I am trying to interpret how an orphan file in FTK has an MFT last written date and time that is prior to the file creation date. Could the creation date be when the file was orphaned?

Quote

8 Forums
15.9 K Topics
92.5 K Posts
19 Online
41.9 K Members

Forum Icons: Forum contains no unread posts Forum contains unread posts

Topic Icons: Not Replied Replied Active Hot Sticky Unapproved Solved Private Closed