Notifications
Clear all
Topic starter
05/09/2014 12:06 am
I am examining the files in the Recycle bin on a Windows 7 system. When looking at a $I file, and in plain text is say Moved to recycle bin 09/01/2014 021235, is this time UTC or local time?
05/09/2014 5:11 am
You aren't looking at the $I file, you are looking at your programs interpretation of the $I file. As such, without knowing the tool, I don't know off hand if they convert it or not.
But, you must be smarter than your tool. $I files are quite easy to parse out. The timestamp for when the file was moved to the Recycle Bin is stored in FILETIME format (UTC) at offset 0x10.
05/09/2014 3:54 pm
…you must be smarter than your tool…
Nice. Well said.
12/09/2014 1:55 am
… and we do not know the file system either.