Earn wrote:
If there's only one entry made to the Index.Dat file, and the MAC date/times are updated accordingly, how do you explain multiple entries for the same LNK file?
Here there is a misunderstanding.
It is not like I am an expert on index.dat's made by MS Office, and not necessarily I can "explain" the genesis of your particular index.dat file.
I am just telling you what I can see and the result of the quick tests I made.
In "normal" operation I am not able to have index.dat with two occurrences of the same .LNK file.
What happens when (say) Excel crashes or (say) multiple Office apps are used (to attempt) opening a file, etc., etc. I cannot really say.
Earn wrote:
The file I'm investigating has 5 instances in the Index.Dat file. Several are in a row but there are instances where another LNK file comes in between. Does this not show that the file was accessed multiple times?
Not to me, since - as said - in "normal" operation I cannot manage to have any duplicate, but it is entirely possible that a different version of MS Office behaves differently.
Earn wrote:
I've only located one instance of the file on the computer so they aren't links to multiple versions of the same file.
Allow me to doubt that.
Since ONLY the file name is recorded in index.dat, for all you know there could be several instances of the same named file in several different USB sticks or CD's or even Network locations.
jaclaz
↧