Quantcast
Channel: Forensic Focus Forums - Recent Topics
Viewing all articles
Browse latest Browse all 20102

General Discussion: Hard Drive Formatted. Need to identify date and time of this

$
0
0
wonderboy wrote: I was mistaken earlier when I said no vol label, there is of course a 4 or 5 digit number! Good. A volume label on FAT 12/16/32 occupies an entry in (root) directory and since it is re-created when formatting it may indicate (if the label was given at the same time of the formatting) the exact date/time the formatting took place. At least, if the label was not given within the format command, it marks a date/time when the label command was given, neededly after the formatting took place. If you simply right click and choose "format", the previous label is kept (I mean the value/string) but the entry in the filesystem is re-created, giving a "useful" date/time. jaclaz

Viewing all articles
Browse latest Browse all 20102

Trending Articles