[sleuthkit-developers] NTFS FileName times now available
Brought to you by:
carrier
From: Brian C. <ca...@sl...> - 2013-06-24 16:32:33
|
The master branch now has code to populate TSK_FS_META.time2.ntfs with the file name times. It took less than 30 minutes to add and I should have done this A LONG time ago, but had been holding off in favor or another design that some of us have talked about that exposed all non-stndard metadata via a hash map. that requires either a C hashmap or changing the API to C++ and has required more thought than we had cycles for. Anyway, I just added the NTFS times. Enjoy and thanks to Kristinn for reminding me that we needed a solution to this. brian |