Viewing real MAC times of a timestomped file

O

oncetwice

New Member
#1
Jun 23, 2017
9
0
#1
Is there any way for me to view the correct MAC times for a files that have their MAC times modified with Timestomp? If there is, where can I find it and is there any software that I need to use?
 
A

athulin

Member
Experienced Member
#2
Oct 18, 2007
730
Ratings
9
18
#2
oncetwice said:
Is there any way for me to view the correct MAC times for a files that have their MAC times modified with Timestomp?
Click to expand...
No. The timestamps have been overwritten.

There may be special situations (say, shadow copies, and such) where it is possible, but not in general.
 
You must log in or register to reply here.

About us

  • Our community began in 2004. Since this time, we have grown to have over 29,000+ members within the DFIR & Cyber Security community.

    We are happy to announce that this forum is now under new ownership with the goal to once again become the main Digital Forensics Forum on the internet for DFIR, OSINT and Cyber Security.

    If you can think of ways to help us improve, please let us know.

    We pride ourselves on offering unbiased, critical discussion among people of all different backgrounds.

    We are working every day to make sure our community is one of the best.

Quick Navigation

Home Forums Contact us

User Menu

login
© 2018 TwiceSafe Software Solutions Inc. | All Rights Reserved
Top Bottom