Re: [sleuthkit-users] timeline

[Angus M. <an...@n-...>]

FAT32 does not record the access time - only the access date. All you know is
that the files were accessed at SOME time on that date.

On Thu Sep 29 16:26 , Geert VAN ACKER <gee...@pa...> sent:

>Dear list,
>
>after creating a timelime with sleuthkit, I get app 700 files with the
>same date-time stamp. It's on a FAT32 volume and all the files have an
>"a" (accessed) timestamp. Most of the files belong to a game, and a few
>system files (dll's, vga driver, ...) are in between it.
>
>The timestamp is Fri Jul 29 2005 00:00:00 after the 700 files, the next
>entry is Fri Jul 29 2005 19:35:46 and from there the files have
>timestamps who are more "logic", I mean they have 1 or 2 second intervals.
>
>Could it be a backup or antivirus prog that accessed all these files,
>700 in one second just seems a lot.
>
>Does anyone has a better explanation ?
>
>Thanks in advance,
>
>Geert VAN ACKER
>
>
>-------------------------------------------------------
>This SF.Net email is sponsored by:
>Power Architecture Resource Center: Free content, downloads, discussions,
>and more. http://solutions.newsforge.com/ibmarch.tmpl
>_______________________________________________
>sleuthkit-users mailing list
>https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
>http://www.sleuthkit.org