Testing the Date Maintenance of the File Allocation Table File System

The directory entries used in the File Allocation Table filesystems maintain a significant amount of file metadata that is of interest to a forensic examiner. This information is maintained by the operating system under normal conditions and may be amended by activities undertaken by the computer user. This paper examines the maintenance of date information when files are being moved between different versions of the FAT filesystem Keywords File systems, dates, file allocation tables, date maintenance, directory entries

• Type: Conference
• Year: 2003
• Where: AUSFORENSICS
• Authors: Tom Waghorn
• Keywords: Allocation Table Filesystems, AUSFORENSICS 2003, Directory Entries, File Allocation Tables, Forensic Engineering