Hi!
I am doing a bit research on windows file timestamp and I haven't found any papers/articles on this issue. I was wondering if anyone here has wrote publication on timestamp. I need to know where is the timestamp stored, how it works and significance to forensic etc. It appears there is no research been done in this area, at least I havent found one yet. If any one has a research on this subject, or can put through in the right direction (any web links etc, etc ) will be appriciated.
Many thanks
Alibax
Can you be more explicit regarding what you're looking for?
There is considerable information available from MS regarding file MAC times, the FILETIME object itself, etc.
http//
http//
"I need to know where is the timestamp stored, how it works and significance to forensic etc."
All of this has been thoroughly documented. I'd start w/ Brian Carrier's "File System Forensic Analysis" book.
HTH
I am writing an academic 'background report' on windows timestamp prior to this I am developing a small tool to retrive the times. In addition, the background report should relate to computer forensic looking at the technologies used and how effective they are! and in general to determine the characteristic of date and times.
I will search for the book thanks.