Aurélien Thierry

A systematic approach to understanding MACB timestamps on Unix-like systems

2022 · Forensic Science International Digital Investigation

File timestamps are used by forensics practitioners as a fundamental artifact. For example, the creation of user files can show traces of user activity, while system files, like configuration and log files, typically reveal when …