keydet89 wrote:
Then, *IF* the version of the operating system you're looking at is Windows, and it's Vista or above, and *IF* the image has Volume Shadow Copies going back far enough, you may be able to establish when the files in question (assuming they're whole and not partial files) could be found within the file system, through hash comparison.
Were/are not Shadow Copies also in XP since SP1? <img src="images/smiles/icon_question.gif" alt="Question" title="Question" />
jaclaz
↧