Re: [sleuthkit-users] Suggestion for activity time line

[Keith R W. <kw...@be...>]

Yes the short FAT name is what I was referring to. I understand your point.

Brian Carrier wrote:

> I like the idea of a separate column for deleted status when the comma 
> delimited output is given.  I'm reluctant to add the short FAT name 
> though (I'm assuming that is what you are referring to as the DOS 
> alias file name) because that is specific to a single file system.
>
> brian
>
>
> Keith R Wood wrote:
>
>> When creating the time line for file activity, place the deleted 
>> indicator, as well as the DOS alias file name in their own separate 
>> column. This would make those elements stand out more when loaded 
>> into a spread sheet.
>>
>