archives

Anders Thulin

Anders Thulin has written 1 posts for Forensic Focus – Articles

Interpretation of NTFS Timestamps

Introduction File and directory timestamps are one of the resources forensic analysts use for determining when something happened, or in what particular order a sequence of events took place. As these timestamps usually are stored in some internal format, additional software is needed to interpret them and translate them into a format an analyst can … Continue reading

Enter your email address to subscribe to this blog and receive notifications of new posts by email.

Join 1,181 other followers