Re: [sleuthkit-users] Suggestion for activity time line

[Brian C. <ca...@sl...>]

I like the idea of a separate column for deleted status when the comma 
delimited output is given.  I'm reluctant to add the short FAT name 
though (I'm assuming that is what you are referring to as the DOS alias 
file name) because that is specific to a single file system.

brian


Keith R Wood wrote:
> When creating the time line for file activity, place the deleted 
> indicator, as well as the DOS alias file name in their own separate 
> column. This would make those elements stand out more when loaded into a 
> spread sheet.
> 
> 
> -------------------------------------------------------
> Using Tomcat but need to do more? Need to support web services, security?
> Get stuff done quickly with pre-integrated technology to make your job 
> easier
> Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
> http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org