Microsoft has a free WMI Utility called "Scriptomatic". I believe it has a module which will do this. I have a copy but do not have the exact URL I got it at. Search Microsoft for "Scriptomatic" and hopefully it will point you to it. -----Original Message----- From: Harlan Carvey [mailto:keydet89at_private] Sent: Friday, March 14, 2003 11:09 AM To: forensicsat_private Subject: Win2K NTFS Change Journal I'm looking for an app that allows the user to enumerate the NTFS change journal on a live Win2K system. Does anyone know of anything? ===== ------------------------------------------------------------------------ Harlan Carvey Computer Security Administrator AIM: carvdawg Yahoo: keydet89 ------------------------------------------------------------------------ __________________________________________________ Do you Yahoo!? Yahoo! Web Hosting - establish your business online http://webhosting.yahoo.com ----------------------------------------------------------------- This list is provided by the SecurityFocus ARIS analyzer service. For more information on this free incident handling, management and tracking system please see: http://aris.securityfocus.com ----------------------------------------------------------------- This list is provided by the SecurityFocus ARIS analyzer service. For more information on this free incident handling, management and tracking system please see: http://aris.securityfocus.com
This archive was generated by hypermail 2b30 : Mon Mar 17 2003 - 20:23:18 PST