last access

Thread view:

Enable EMail Alerts

Start New Thread

Thread rating:

anonymous@discussions.microsoft.com - 27 May 2004 03:45 GMT

will right clicking a file and deleting a file be recorded
as a last access

Reply to this Message

Tim Slattery - 27 May 2004 13:44 GMT

>will right clicking a file and deleting a file be recorded
>as a last access

Since the access times are recorded in the file's directory entry, and
deleting the file destroys its directory entry, then if the file is
deleted, there's no place to record a "last access".

Signature

Tim Slattery
MS MVP(DTS)
Slattery_T@bls.gov

Reply to this Message

anonymous@discussions.microsoft.com - 28 May 2004 03:45 GMT

I received a forensic expert's report claiming that he can
determine that some deleted files were last accessed on a
particular date. The computer runs win 98.

>-----Original Message-----
>
[quoted text clipped - 4 lines]
>deleting the file destroys its directory entry, then if the file is
>deleted, there's no place to record a "last access".

Reply to this Message

Joep - 28 May 2004 14:05 GMT

> I received a forensic expert's report claiming that he can
> determine that some deleted files were last accessed on a
> particular date. The computer runs win 98.

When a file is deleted in FAT/FAT32:

- Clusters are marked free in the FAT
- The first character of the filename in directory entry is replaced by E5h.

The rest of the directory entry remains until it's overwritten, including
all info; attributes, start cluster, size and creation, modified and last
access date. The date of the deletion itself isn't recorded anywhere. If the
file was deleted in Windows while the recycle bin wasn't emptied, then the
deletion date can be retrieved by accessing the recylcle bin.

--
Joep

Reply to this Message