Re: [sleuthkit-users] help----metadata tools

[Brian C. <ca...@sl...>]

I don't know of any comprehensive tools that take a file name and  
search the system for all references to it.  File system tools like  
TSK / Autopsy (and others) will give you the last modified, accessed,  
created, changed, etc times, but that is not a full history.  It  
won't tell you which app did the creation or modification or when  
each app printed it though.

You can make timelines with TSK and Autopsy as well, but again this  
is for only the last times and not a "complete history".  The  
complete history is not saved on most systems.

brian


On Jan 30, 2006, at 12:53 AM, sr...@nm... wrote:

> hi,
> thanks for replying.
> i mean i want a tool that can give me the
> 1)history of the file(when the file is created,modified,printed,edited
> anything that is useful)
> 2)time analysis(i want the tool to display the time it is
> created,modified,printed,edited anything that is useful)
>
> i mean i need the complete history of the file.
>
> please let me know as soon as possible.
>
> thanks again for replying.
>
>
>
> -------------------------------------------------------
> This SF.net email is sponsored by: Splunk Inc. Do you grep through  
> log files
> for problems?  Stop!  Download the new AJAX search engine that makes
> searching your log files as easy as surfing the  web.  DOWNLOAD  
> SPLUNK!
> http://sel.as-us.falkag.net/sel? 
> cmd_______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org