Re: [sleuthkit-users] Timeline and dating ...
Brought to you by:
carrier
From: Brian C. <ca...@sl...> - 2010-06-05 18:56:16
|
Hi Ed, Can you explain more about what you mean be classification? Are you seeing only created dates in the timeline? brian On Jun 4, 2010, at 11:49 AM, s s wrote: > Hey all, > > When i create a timeline with autopsy interface, the classification is being done by "created dates". > I'd like to make this classification by "modified dates". > ( my case is a NTFS format and i need to classify the file's written dates on the system) > Is there any options i forgot to do it ? Or is it just not possible ? > Anyway, if anyone know the command line to do such, i appreciate. > > Best Regards, > Ed. > > > > ------------------------------------------------------------------------------ > ThinkGeek and WIRED's GeekDad team up for the Ultimate > GeekDad Father's Day Giveaway. ONE MASSIVE PRIZE to the > lucky parental unit. See the prize list and enter to win: > http://p.sf.net/sfu/thinkgeek-promo_______________________________________________ > sleuthkit-users mailing list > https://lists.sourceforge.net/lists/listinfo/sleuthkit-users > http://www.sleuthkit.org |