tag:blogger.com,1999:blog-1746946614390371171.post6751137962886175132..comments2023-05-09T02:31:13.939-07:00Comments on Computer Forensics, Malware Analysis & Digital Investigations: Custom FILETIME DateClass to display millisecond granularityLance Muellerhttp://www.blogger.com/profile/15789264000499223230noreply@blogger.comBlogger3125tag:blogger.com,1999:blog-1746946614390371171.post-67010990704177350152011-02-16T20:22:42.698-08:002011-02-16T20:22:42.698-08:00Lance, Menz's MFTRipper Pro has provided the N...Lance, Menz's MFTRipper Pro has provided the NTFS time stamps to the millisecond since 2007. He also said you are in his Forensic 300 list.<br /><br />ThomAnonymousnoreply@blogger.comtag:blogger.com,1999:blog-1746946614390371171.post-72175567916470294832011-02-09T18:25:45.283-08:002011-02-09T18:25:45.283-08:00Binarybod...
I wrote this class to address some o...Binarybod...<br /><br />I wrote this class to address some of the issues with the EnCase DateClass. <br /><br />I often use TimeLord to verify my results for jobs and used it to verify values for SEEBDateClass.... Its a very useful application.<br /><br />I hope people get some use with this class.<br /><br />Regards<br />BJBJhttps://www.blogger.com/profile/04756344877828126356noreply@blogger.comtag:blogger.com,1999:blog-1746946614390371171.post-61818399653550654662011-02-07T02:15:34.457-08:002011-02-07T02:15:34.457-08:00Great post - thank you. I'll be making much us...Great post - thank you. I'll be making much use of this library. Hopefully Guidance will add something like this library to their own API.<br /><br />I've had a bee in my bonnet for some time that forensic software rarely allows you to display the full time. You don't need this functionality in many cases the nearest second is fine but just once in a while it is nice to see the full granularity that NTFS records. It's one of the functions I included in Timelord:<br />(http://computerforensics.parsonage.co.uk/timelord/timelord.htm)Anonymousnoreply@blogger.com