Forensics: Why is there no “Entry Modified” Date?

EnCase can only show the entry modified date if it exists, and it only exists  for certain file systems, e.g NTFS.

FAT, for example, does not record this information.

If the Entry Modified data cannot be seen in EnCase, during a forensic examination, this is probably because it is a file system that does not support that date.

Advertisements

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

%d bloggers like this: