keydet89 wrote:
twjolson wrote:
Since you already have a suspicion that it is Firefox, I wouldn't bother with a timeline yet. I would take a test VM, do various tests with Firefox, and see if you can create analogous files on your own. Why waste the step of making a timeline if you may already have the answer?"Waste the step"?
Well, my thinking is that if he does a timeline, and if he sees that Firefox is executed just prior to the .part files being created, he then has to replicate the creation of the .part files anyways.
Since he suspects that Firefox created the .part files, he could cut out the timeline and try and replicate the .part files, saving the time of creating the timeline (even if it is quick and easy).
Time is money, and if he can get to the answer quicker (and still have it be right), all the better. That's all I meant.
↧