Hi all,
This is my first post so i'll start by saying hi to everyone and and also saying thanks to all the members and maintainers of Forensic Focus as it has been a really fantastic resource over the past couple of weeks.
I'm posting to see if anyone can help me understand something regarding timestamps on CD media. I've been analysing some .lnk files that point to some content on a CD and have noticed that while they reference the Created and Last Written timestamps of the file, they do not list the Last Accessed time. Now I assumed this was because the file is on read-only media and as such its not possible to update the timestamps, or possibly because UDF simply doesn't support the last accessed timestamp. (If anyone can tell if me which of these, if either, are true it would be a great help)
The problem is i've now found some other .lnk files also supposedly pointing to some content on CD that does have the last accessed timestamp. Anyone have any ideas on this? Maybe i'm overlooking the obvous here but I'd really appreciate it if someone could clarify for me how timestamps work on CD media.
Many Thanks,
Dave
Unfortunately the dates and times recorded on a CD vary according to the software used to write the disk. They really shouldn't but I find they do! Sometimes there is just a modified date, sometimes modified and created, sometimes both BUT they are identical when they shouldn't be.
The one thing that is pretty standard is that last accessed is not listed on a CD-ROM. Have you checked the Vol Type in the lnk file, just to confirm?
