Comments on: Article on Dissecting NTFS Hidden Streams http://niiconsulting.com/checkmate/2006/07/17/article-on-dissecting-ntfs-hidden-streams/ An Information Security Blog by NII Consulting Tue, 06 Jul 2010 12:58:32 +0000 hourly 1 http://wordpress.org/?v=3.0 By: amita http://niiconsulting.com/checkmate/2006/07/17/article-on-dissecting-ntfs-hidden-streams/comment-page-1/#comment-71 amita Sun, 04 May 2008 01:13:32 +0000 http://www.niiconsulting.com/checkmate/2006/07/article-on-dissecting-ntfs-hidden-streams/#comment-71 I would appreciate if you could answer to these questions so I can send hard drive for forensics: 1. Few files & folders had been hidden in My Documents on a PC. These are now un-hidden. Can Forensic software tell about these files & folders: a. Were these files & folders ever hidden b. When were these files & folders hidden c. Where were these files & folders hidden. d. When these files & folders were un-hidden. 2. A computer's date & time was changed and now reset to current time. Does a computer keep a log of this date & time change. If yes, where? Thank Amita I would appreciate if you could answer to these questions so I can send hard drive for forensics:
1. Few files & folders had been hidden in My Documents on a PC. These are now un-hidden.

Can Forensic software tell about these files & folders:
a. Were these files & folders ever hidden
b. When were these files & folders hidden
c. Where were these files & folders hidden.
d. When these files & folders were un-hidden.

2. A computer’s date & time was changed and now reset to current time.
Does a computer keep a log of this date & time change.
If yes, where?

Thank
Amita

]]> By: keydet89 http://niiconsulting.com/checkmate/2006/07/17/article-on-dissecting-ntfs-hidden-streams/comment-page-1/#comment-70 keydet89 Tue, 01 Aug 2006 12:43:08 +0000 http://www.niiconsulting.com/checkmate/2006/07/article-on-dissecting-ntfs-hidden-streams/#comment-70 Quick question, guys...your Properties tag (first image) shows a file with a .doc extension. Is this an MSWord document? If so, the properties aren't maintained in an ADS, but within the OLE document itself. Harlan Quick question, guys…your Properties tag (first image) shows a file with a .doc extension. Is this an MSWord document? If so, the properties aren’t maintained in an ADS, but within the OLE document itself.

Harlan

]]>