文章介绍了一项技术挑战：测试常用取证工具（如FTK Imager、Xways等）在处理FAT32文件系统时间戳时的表现。FAT32仅记录日期而不存储访问时间戳，但部分工具曾错误地将零时间视为有效时间并进行时区调整。参与者需提交至少两个工具的测试结果，并有机会赢取$100 Amazon Giftcard。 2025-4-21 03:28:0 Author: www.hecfblog.com(查看原文) 阅读量:9 收藏
By
•
April 20, 2025
•
Daily Blog
fat32
sunday funday
timestamps
•
Hello Reader,
It's an Eng world and we are just living in it, unless of course you take the time to put in an entry this week and win! This week we are changing courses to an old file system problem with some utilities.
The Prize:
$100 Amazon Giftcard
The Rules:
- You must post your answer before Friday 4/25/25 7PM CST (GMT -6)
- The most complete answer wins
- You are allowed to edit your answer after posting
- If two answers are too similar for one to win, the one with the earlier posting time wins
- Be specific and be thoughtful
- Anonymous entries are allowed, please email them to [email protected]. Please state in your email if you would like to be anonymous or not if you win.
- In order for an anonymous winner to receive a prize they must give their name to me, but i will not release it in a blog post
- AI assistance is welcomed but if a post is deemed to be entirely AI written it will not qualify for a prize.
The Challenge:
FAT32 does not store a time stamp for access dates, it only records the date. However many tools have or have in the past actually treated the zero time entry as a real time entry and adjusted it for time zones. Test your favorite tools such as , ftk imager, xways, axiom, encase, autopsy your choice but you must submit at least two and show if they are correctly handling FAT32 timestamps.
如有侵权请联系:admin#unsafe.sh