@port139 Blog

基本的にはデジタル・フォレンジックの技術について取り扱っていますが、記載内容には高確率で誤りが含まれる可能性があります。

DisableLastAccess and 2 (System Managed, Disabled)

Note:I translated Japanese into English using Google Translate.
Thank you, Google.  

I confirmed DisableLastAccess in verification environment. The size of C: is 40 GB.
The value of DisableLastAccess was "2" and "Disabled"...."Disabled"???

f:id:hideakii:20181209152548p:plain

f:id:hideakii:20181209152700p:plain

I confirmed the settable value with disablelastaccess.

f:id:hideakii:20181209153318p:plain

f:id:hideakii:20181209155011p:plain

I saw Forensic Lunch Test Kitchen 12/6/18 and understood the meaning of "Disabled"!
Thank you!

www.hecfblog.com

 

Check the timestamp of Accessed in the property of the sample image file.

f:id:hideakii:20181209185121p:plain

Again, display the properties. (File is not opened)

Accessed has been updated.

f:id:hideakii:20181209185258p:plain

Connect the USB memory(58.5GB) and repeat the same procedure.

f:id:hideakii:20181209190230p:plain

f:id:hideakii:20181209190045p:plain

Again, display the properties. (File is not opened)

Accessed has been updated.

f:id:hideakii:20181209190143p:plain

I added a 150 GB volume to the test environment.

f:id:hideakii:20181209190811p:plain

Check the time stamp of the sample image file.

>fsutil file layout Dragonfly.jpg
Last Access Time : 12/9/2018 10:09:20 (UTC)

f:id:hideakii:20181209202313p:plain

Display the properties. (File is not opened)

Again, Check the time stamp of the sample image file.
Last Access Time has been updated.

f:id:hideakii:20181209203752p:plain

Muuu??
Time stamp resolution is not 1 hour?

f:id:hideakii:20181209204531p:plain

I need to continue testing.


Verification environment: Windows 10 1083

Reference URL:

dfir.ru

File Times - Windows applications | Microsoft Docs

f:id:hideakii:20181209205334j:plain