mtime, other attributes aren't preserved by tsk_recover
Brought to you by:
carrier
Menu
▾
▴
#219 mtime, other attributes aren't preserved by tsk_recover
Using sleuthkit-4.2.0 on FreeBSD-10.2/i386, I was able to recover almost all (I hope) files from a damaged partitions (UFS2). Thank you!
However, all of the recovered files and directories have timestamps from the time of recovery and the ownership of root.
It would've been even nicer, if the recovery process preserved the modification, access, creation and times stored on the inodes, as well as group and ownership information and other attributes such as flags and ACLs.
