On Mon, Aug 31, 2009 at 06:57, Mathew Brown<
mathewbrown@...> wrote:
> This may be a really simple question, but I was wondering what it
> means when you find a file with a timestamp of "Thu Jan 01 1970"?
> Clearly the file wasn't created then, so what does it mean? I run
> into this quite often. Thanks.
>
> Date,Size,Type,Mode,UID,GID,Meta,File Name
>
> Thu Jan 01 1970 02:00:00,1000,..c.,r/rrwxrwxrwx,0,0,11,C:/1.txt
> Thu Jan 01 1970 02:00:00,20124,..c.,r/rrwxrwxrwx,0,0,11,C:/cover.jpg
A timestamp of or around (depending on timezone correction) the epoch
- January 1, 1970 at midnight - indicates a value of 'zero'. Someone
could have zeroed the timestamp, or the analysis program could have
not found one, or there's an invalid value. Look up epoch or UNIX
time for a more in-depth explanation.
------------------------------------------------------------------------------
Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day
trial. Simplify your report design, integration and deployment - and focus on
what you do best, core application coding. Discover what's new with
Crystal Reports now.
http://p.sf.net/sfu/bobj-july_______________________________________________
sleuthkit-users mailing list
https://lists.sourceforge.net/lists/listinfo/sleuthkit-usershttp://www.sleuthkit.org
