[sleuthkit-developers] [ autopsy-Bugs-3388421 ] Autopsy not displaying C-time correctly when adding Notes

[SourceForge.net <no...@so...>]

Bugs item #3388421, was opened at 2011-08-08 17:23
Message generated for change (Tracker Item Submitted) made by skelm
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=477897&aid=3388421&group_id=55687

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: Notes / Reports
Group: None
Status: Open
Resolution: None
Priority: 5
Private: No
Submitted By: skelm (skelm)
Assigned to: Nobody/Anonymous (nobody)
Summary: Autopsy not displaying C-time correctly when adding Notes

Initial Comment:
When adding Notes while analysing a FAT32 file system Autopsy (v2.24) alway sets the c-time to Jan. 1, 1970 while istat (v3.2.2) is correct about this.

Two examples:

# istat -o 63 image.dd 2938902
Directory Entry: 2938902
Allocated
File Attributes: File, Archive
Size: 2375
Name: obfusca.ted

Directory Entry Times:
Written:        Tue Oct 25 14:04:12 2005
Accessed:       Sun Oct 23 00:00:00 2005
Created:        Tue Oct 25 14:04:10 2005

Autopsy output:
Volume: vol2 Meta: 2938902
M-time: Tue Oct 25 14:04:12 2005
A-time: Sun Oct 23 00:00:00 2005
C-time: Thu Jan 1 00:00:00 1970


======================================================
# istat -o 63 image.dd 267897980
Directory Entry: 267897980
Not Allocated
File Attributes: File, Archive
Size: 193485
Name: 5224E5~1

Directory Entry Times:
Written:        Mon Oct 24 12:28:40 2005
Accessed:       Mon Oct 24 00:00:00 2005
Created:        Mon Oct 24 12:27:55 2005

Autopsy output:
Volume: vol2 Meta: 267897980
M-time: Mon Oct 24 12:28:40 2005
A-time: Mon Oct 24 00:00:00 2005
C-time: Thu Jan 1 00:00:00 1970



----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=477897&aid=3388421&group_id=55687