zoukankan      html  css  js  c++  java
  • Completely change MACE timestamps?

    Hi,

    One of my friends Sandy asked me about the possibility of completely change MACE timestamps. As everybody knows that some tools could change MAC timestamps only. I told her that a tool whose name is "Timestomp" could change MACE timestamps,including Entry Modified Time. She was very surprise and ask me how to use "Timestomp". I will show you as below:

    1. A file - test.txt . Look at its MAC timestamps "10/29/2013 09:44:35".

    2. Use Timestomp to show MACE timestamps. 

    3. Now I use Timestomp to change MACE timestamps to earlier time such as "10/08/2005 14:34:56". You could see the MACE timestamps change as exaclty what I want.

    4.If you are not sure MACE do change or not, I use other tool to verify the MACE timestamp of this file test.txt again. It works! All timestamps become "10/08/2005 14:34:56".

    5. My friend she wonder if suspect use Timestomp to change MACE timestamps, how could I figure it out? Fortunately, there are two kinds of timestamps in MFT. They are Standard info and Filename info. I dump an MFT to csv and you could see them clearly. Even Timestomp could change MACE timestamps, it could only change Sandard info attributes, not including Filename info attributes. So we could take a look at MFT dump results and see if there is any abnormal timestamps between those two timestamp attributes.

  • 相关阅读:
    flash时间控制
    内联元素及其特性 &块元素
    清除浮动两种方法
    ie6 lineheight失效 待测试
    表单 文字和输入框对齐的最简单的方法
    ie6bugie6默认的最小高度是设定字体的高度
    CSS triangle generator
    解释性的语言vs编译性语言
    outerHeight(options)
    获取input的value值得 jQuery插件
  • 原文地址:https://www.cnblogs.com/pieces0310/p/4570415.html
Copyright © 2011-2022 走看看