Is there a way to access original MAC (Modify, Create, Access) times of specific file?
Not talking about basicfileattributes which provides system/Windows's times.
Asked
Active
Viewed 28 times
0
-
1Can you explain what you mean by "original" vs. "system/Windows's" time? Who is supposed to keep track of those values if not your OS? And maybe even more useful: can you provide an example where those supposed values differ? – Joachim Sauer Mar 01 '19 at 17:46
-
The operative system provides System/Windows's MAC times and reflects data upon the entrance to the system. Example - Copy and paste a file from Windows to a Pen drive - The creation time for this file will be equal to time upon which the file entered the pen drive. BUT even tho this is just an image of original file, many file formats are still keeping the Original MAC times (Date in which file was created and not moved from win to USB). FTK is a common program used in computer forensics which can access original MAC's (If specific file format is storing information about it). – Bart Mar 02 '19 at 00:14