[prev in list] [next in list] [prev in thread] [next in thread] 

List:       sleuthkit-users
Subject:    Re: [sleuthkit-users] Metadata help
From:       Simson Garfinkel <simsong () acm ! org>
Date:       2008-10-05 0:38:03
Message-ID: 36917AC6-2C7B-4B08-9F2A-CB9D94AE56FE () acm ! org
[Download RAW message or body]

Hi, Charles.

How are you getting the creation date and original creator? From the  
Word Document Properties? (You didn't say what kind of file type you  
are working with.)

The file name is normally kept in the file system.  So if you are  
recovering files by file carving, by definition, you don't have it.


On Oct 4, 2008, at 5:31 PM, charles@charlestendell.com wrote:

>
>
> Afternoon folks:
> First let me say I'm new to the mailing list.
> I need a little help, I've got a few files that I have carved using  
> foremost. When I review the meta data I can see the original creator  
> and the creation date but cannot see the original file name. How can  
> I recover this data? Also autopsy, 2.08, when creating a timeline on  
> the same media shows the files with a deletion date but I have no  
> way of connecting the timeline data with the carved files.
>
> Thanks,
> Charles Tendell
> Network Security & E-discovery
> http://charlestendell.com
> 303.872.0115
> Sent via BlackBerry
>
> -------------------------------------------------------------------------
> This SF.Net email is sponsored by the Moblin Your Move Developer's  
> challenge
> Build the coolest Linux based applications with Moblin SDK & win  
> great prizes
> Grand prize is a trip for two to an Open Source event anywhere in  
> the world
> http://moblin-contest.org/redirect.php?banner_id=100&url=/
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org
>


-------------------------------------------------------------------------
This SF.Net email is sponsored by the Moblin Your Move Developer's challenge
Build the coolest Linux based applications with Moblin SDK & win great prizes
Grand prize is a trip for two to an Open Source event anywhere in the world
http://moblin-contest.org/redirect.php?banner_id=100&url=/
_______________________________________________
sleuthkit-users mailing list
https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
http://www.sleuthkit.org
[prev in list] [next in list] [prev in thread] [next in thread]