Re: [sleuthkit-users] body file + checksum - any tools?
Brought to you by:
carrier
From: RB <ao...@gm...> - 2014-03-14 14:10:38
|
On Fri, Mar 14, 2014 at 7:27 AM, Brian Carrier <ca...@sl...> wrote: > tsk_gettimes will display two lines for each file. One with times from STD_INFO and one from $FILE_NAME. It has the limitation that if there are multiple $FILE_NAME attributes, it shows only one. I see that, and that's pretty cool - regardless of the limitation that's extremely useful. Looks like "fls -arpm/" may be permanently replaced for me now. |