A good starting point for a primer on Modified, Accessed, Create dates would be the definitions contained in the Encase manual. As far as the creation date of a CDR goes one place to start would be the volume serial number which you can see by running the 'vol' command from a prompt. This will help if you have a suspected date range to test for. I also remember there being a pretty extensive thread on cdfs structure on this mailing list. As with just about any and all date time information though you have to remember that computers don't really know what time it is on their own and that all date time information depends on the system date time settings. Robert Goto Senior Technical Advisor Electronic Evidence Discovery Inc ----- Original Message ----- From: "Michael Edwards" <medwards@digital-legal.com> To: <forensicsat_private> Sent: Friday, July 11, 2003 12:57 PM Subject: Creation / modification / access dates > Greetings to the list. > > Firstly, is there any way to determine the creation date of a CD-ROM - is > that information stored somewhere as part of the CDFS? > > Secondly, I'm looking for recommended reading and / or sources of > information on creation / modification / access dates (primarily for > Windows) in general. Good primers on what activities do and don't modify > them, etc. I've found some information on line, and some of Microsoft's > official tech notes on the date formats - but am hoping to find a collected > source of information. > > Thanks for any help! > > > Michael Edwards > Blank & Associates P.S. - 206.256.9699 x36 > 2001 Western Avenue, Suite 250 - Seattle, Washington 98121 > > CONFIDENTIALITY NOTICE: The contents of this message are intended solely > for the person to whom this message is addressed, and may be protected from > disclosure or dissemination by the attorney-client privilege or other > guarantee of confidentiality. If you believe you have received this > message in error, please notify the sender at > <mailto:medwards@digital-legal.com>medwards@digital-legal.com and destroy > all copies. > > > ----------------------------------------------------------------- > This list is provided by the SecurityFocus ARIS analyzer service. > For more information on this free incident handling, management > and tracking system please see: http://aris.securityfocus.com > > ----------------------------------------------------------------- This list is provided by the SecurityFocus ARIS analyzer service. For more information on this free incident handling, management and tracking system please see: http://aris.securityfocus.com
This archive was generated by hypermail 2b30 : Mon Jul 14 2003 - 05:40:31 PDT