はてなブックマーク

MAC(B) Timestamps across POSIX implementations (Linux, OpenBSD, FreeBSD) File timestamps are crucial forensics artifacts when investigating a machine during a security incident, they are regularly modified and can provide both primitive information (when the file was last modified) and inferred information (when the file was probably moved there from another file system). The “Windows Time Rules”