Back to Help Documents
tsk_gettimes will extract the metadata from the file systems in an image. The results will be a body file that can be used by mactime to make a timeline. This tool is equivalent to running fls ‘-m’ on each file system in an image.
Last modified: 2010-10-28