Difference between revisions of "Tsk gettimes"
From SleuthKitWiki
(Created page with "Back to Help Documents tsk_gettimes will extract the metadata from the file systems in an image. The results will be a body file that can be used by mactime to make a [...") |
(No difference)
|
Latest revision as of 18:25, 27 October 2010
Back to Help Documents
tsk_gettimes will extract the metadata from the file systems in an image. The results will be a body file that can be used by mactime to make a timeline. This tool is equivalent to running fls '-m' on each file system in an image.
