This is a free and open peer to peer medium for digital and computer forensics professionals and students. Please help us maintain it by contributing and perhaps linking to us from your own website.
55953531 page views since August 2004
Computer Forensics World: Forums
Computer Forensics World :: View topic - Viewing real MAC times of a timestomped file
oncetwice Newbie Joined: Jun 24, 2017 Posts: 3
Posted: Sun Jun 25, 2017 6:16 pm Post subject: Viewing real MAC times of a timestomped file
Is there any way for me to view the correct MAC times for a files that have their MAC times modified with Timestomp? If there is, where can I find it and is there any software that I need to use?
athulin Newbie Joined: Oct 19, 2007 Posts: 240
Posted: Mon Jun 26, 2017 5:11 am Post subject: Re: Viewing real MAC times of a timestomped file
oncetwice wrote: Is there any way for me to view the correct MAC times for a files that have their MAC times modified with Timestomp?
No. The timestamps have been overwritten.
There may be special situations (say, shadow copies, and such) where it is possible, but not in general.
All times are GMT + 10 Hours
You cannot post new topics in this forum You cannot reply to topics in this forum You cannot edit your posts in this forum You cannot delete your posts in this forum You cannot vote in polls in this forum
TMs property of their respective owner. Comments property of posters. © 2007 Computer Forensics Science World. Digital forensic computing news syndication: or Software is copyrighted phpnuke.org (c)2003, and is free under agreement. All Rights Are Reserved.