PaulDotCom mailing list archives

Forensic File Analysis

From: gbugbear at gmail.com (Tim Mugherini)
Date: Wed, 10 Dec 2008 17:43:10 -0500

For ntfs to ntfs try robocopy

http://en.wikipedia.org/wiki/Robocopy

If ntfs perms on a domain the owner would show up as the sid when off domain

I believe it preserves all atributes and it can be scripted

On 12/10/08, Kevin Shortt <kevin.shortt at gmail.com> wrote:

Any free tools out there that will preserve a windows file properties
(access time, creator, etc..) for evidentiary purposes?

Any and all leads/suggestions appreciated.

Thanks..

-Kevin


-- 
Sent from my mobile device

Current thread:

Forensic File Analysis Kevin Shortt (Dec 10)
- Forensic File Analysis Tim Mugherini (Dec 10)
- Forensic File Analysis infolookup at gmail.com (Dec 10)
  - Forensic File Analysis Chris Gerling (Dec 10)
    - Forensic File Analysis iamnowonmai (Dec 10)
    - Forensic File Analysis Chris Gerling (Dec 10)
    - Forensic File Analysis iamnowonmai (Dec 10)
    - Forensic File Analysis Chris Gerling (Dec 10)
    - Forensic File Analysis Tim Krabec (Dec 10)
  - Forensic File Analysis wishi (Dec 11)
    - Gonzor / Themiddler / PEScrambler Nils (Dec 16)
    - Gonzor / Themiddler / PEScrambler Karl Schuttler (Dec 16)

(Thread continues...)