MAC times

From ForensicsWiki
Revision as of 16:15, 24 November 2007 by Alex (Talk | contribs)

Jump to: navigation, search

MAC times are timestamps of the latest modification, access or change of a certain file. With Windows Vista, the registry key 'HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\FileSystem\NtfsDisableLastAccessUpdate' is set to '1' by default, which means that no last access timestamp will be written at all.


External Links