Hi All, I sometimes need find out when a file or directory on a machine was deleted, actual recovery of the file is not always necessary. For various reasons the time and expense of a proper forensics investigation is not always possible or suitable so I am looking for standard undelete tools that can help me. So far I have looked at a variety of tools but although a number look good none of them seem to tell me when the file was deleted. These have included Norton Utilities, File Scavenger, Remote Restore, GetDataBack, Uneraser. The Norton tool gives me the deleted time/date but it needs to be running when the files are deleted. The other tools give me created, modified and last accessed time/dates depending on the tool but not the deleted time/date. Does the modified or last accessed time/date actually list when the file was deleted or is this info something else again. The kind of tool or tools I am looking for need to work on all types of FAT and NTFS file system, run under windows and need to show when the file was deleted. Can anyone make any recommendations? Thanks. Alan _________________________________________________________________ Choose an Internet access plan right for you -- try MSN! http://resourcecenter.msn.com/access/plans/default.asp ----------------------------------------------------------------- This list is provided by the SecurityFocus ARIS analyzer service. For more information on this free incident handling, management and tracking system please see: http://aris.securityfocus.com
This archive was generated by hypermail 2b30 : Sat Oct 19 2002 - 13:51:31 PDT