sleuthkit-users

[sleuthkit-users] Suggestion for activity time line

[Keith R W. <kw...@be...>]

When creating the time line for file activity, place the deleted 
indicator, as well as the DOS alias file name in their own separate 
column. This would make those elements stand out more when loaded into a 
spread sheet.

Re: [sleuthkit-users] Suggestion for activity time line

[Brian C. <ca...@sl...>]

I like the idea of a separate column for deleted status when the comma 
delimited output is given.  I'm reluctant to add the short FAT name 
though (I'm assuming that is what you are referring to as the DOS alias 
file name) because that is specific to a single file system.

brian


Keith R Wood wrote:
> When creating the time line for file activity, place the deleted 
> indicator, as well as the DOS alias file name in their own separate 
> column. This would make those elements stand out more when loaded into a 
> spread sheet.
> 
> 
> -------------------------------------------------------
> Using Tomcat but need to do more? Need to support web services, security?
> Get stuff done quickly with pre-integrated technology to make your job 
> easier
> Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
> http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org

Re: [sleuthkit-users] Suggestion for activity time line

[Keith R W. <kw...@be...>]

Yes the short FAT name is what I was referring to. I understand your point.

Brian Carrier wrote:

> I like the idea of a separate column for deleted status when the comma 
> delimited output is given.  I'm reluctant to add the short FAT name 
> though (I'm assuming that is what you are referring to as the DOS 
> alias file name) because that is specific to a single file system.
>
> brian
>
>
> Keith R Wood wrote:
>
>> When creating the time line for file activity, place the deleted 
>> indicator, as well as the DOS alias file name in their own separate 
>> column. This would make those elements stand out more when loaded 
>> into a spread sheet.
>>
>