tag:blogger.com,1999:blog-1466903740262764947.post1067169220066486897..comments2023-12-28T03:01:49.774-06:00Comments on Hacking Exposed Computer Forensics Blog: Daily Blog #557: Changes in the NtfsDisableLastAccessUpdate keyDavid Cowenhttp://www.blogger.com/profile/17629115910611763170noreply@blogger.comBlogger4125tag:blogger.com,1999:blog-1466903740262764947.post-21661488085080965702018-12-13T19:39:55.086-06:002018-12-13T19:39:55.086-06:00Thanks for reading!Thanks for reading!David Cowenhttps://www.blogger.com/profile/17629115910611763170noreply@blogger.comtag:blogger.com,1999:blog-1466903740262764947.post-47967385658942738742018-12-13T19:39:41.908-06:002018-12-13T19:39:41.908-06:00I don't disagree that its a detection, just se...I don't disagree that its a detection, just seems like a strange decision to turn it on with a gigabyte limit constraint. David Cowenhttps://www.blogger.com/profile/17629115910611763170noreply@blogger.comtag:blogger.com,1999:blog-1466903740262764947.post-87992736250455432792018-12-11T13:01:51.918-06:002018-12-11T13:01:51.918-06:00As to the why? I think for anti forensics this is ...As to the why? I think for anti forensics this is a good detection to see if CAW (create access write) was tamperedKismet Graphicshttps://www.blogger.com/profile/15841315341933076064noreply@blogger.comtag:blogger.com,1999:blog-1466903740262764947.post-75469744449758843322018-12-11T06:10:50.726-06:002018-12-11T06:10:50.726-06:00Good catch and thanks for the post. Good catch and thanks for the post. Anonymoushttps://www.blogger.com/profile/15892463252714005835noreply@blogger.com