Re: Was the HD formatted? (under Win95)

From: Brian Carrier (carrierat_private)
Date: Thu Oct 10 2002 - 06:15:15 PDT

  • Next message: Robert Goto: "Re: Was the HD formatted? (under Win95)"

    On Wednesday, October 9, 2002, at 06:06  PM, InfoEmergencias - Luis 
    Gómez wrote:
    
    <...>
    
    > ---------------------- Brian Carrier
    > "Note that in FAT, the access time is only accurate to the day (not
    > time), so it will show up in the timeline at 00:00:00 no matter what
    > time it was run.  That could be why you do not see it in the final
    > pages."
    >
    > It's strange, as I do see different times in the timeline. Maybe it's
    > some bogus behaviour of TASK when accessing FAT filesystems? (as TCT 
    > was
    > not initially developed to work upon these filesystems). Dunno...
    >
    
    Refer to the FAT spec:
    	http://www.microsoft.com/hwdev/hardware/fatgen.asp
    
    Access time is optional and only accurate to the day.
    Create time is also optional and is accurate to a tenth of a second
    Write time is required, and is accurate to the second.
    
    The other times you are seeing are the Write (the 'M-time' in TASK) and 
    the Create (The 'C-Time' in TASK) times.
    
    brian
    
    -----------------------------------------------------------------
    This list is provided by the SecurityFocus ARIS analyzer service.
    For more information on this free incident handling, management 
    and tracking system please see: http://aris.securityfocus.com
    



    This archive was generated by hypermail 2b30 : Thu Oct 10 2002 - 06:19:02 PDT