±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 0 Overall: 36595
New Yesterday: 0 Visitors: 124

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Videos

±Latest Jobs

penulatimate date

Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
Page 1, 2  Next 
  

giandega
Senior Member
 

penulatimate date

Post Posted: Oct 17, 19 06:46

dear all,
I've got the e01 copy of a the disk with win 7. Is it possible to know when was the penultimate date in which a file has been opened? The file is zip and the application is 7zip
thanks  
 
  

keydet89
Senior Member
 

Re: penulatimate date

Post Posted: Oct 17, 19 11:04

What is a "penultimate" date?  
 
  

giandega
Senior Member
 

Re: penulatimate date

Post Posted: Oct 17, 19 11:27

google translate wrote this.
NOt the last date in which the file has been open but the date before  
 
  

jaclaz
Senior Member
 

Re: penulatimate date

Post Posted: Oct 17, 19 12:31

- giandega
google translate wrote this.
Not the last date in which the file has been open but the date before


No, usually only odd (dispari) previous archive files openings are logged:
-1 (last time)
-3 (third last)
-5
etc.

Come on ...

jaclaz
_________________
- In theory there is no difference between theory and practice, but in practice there is. - 
 
  

keydet89
Senior Member
 

Re: penulatimate date

Post Posted: Oct 17, 19 17:01

- giandega

NOt the last date in which the file has been open but the date before


Possibly, yes.

Find the profile for the user that opened it, and extract the NTUSER.DAT and USRCLASS.DAT files.

Now do the same of the same files in all available VSCs.

Map out all MRU entries related to the file in question from the hives; RecentDocs, 7Zip MRU, ComDlg32, etc. I'd also include shellbags, although the entries will be related to Windows Explorer and not 7Zip.

Again, it's possible...not definitive. So...maybe.  
 
  

jaclaz
Senior Member
 

Re: penulatimate date

Post Posted: Oct 17, 19 18:12

- keydet89


Possibly, yes.

Find the profile for the user that opened it, and extract the NTUSER.DAT and USRCLASS.DAT files.

Now do the same of the same files in all available VSCs.

Map out all MRU entries related to the file in question from the hives; RecentDocs, 7Zip MRU, ComDlg32, etc. I'd also include shellbags, although the entries will be related to Windows Explorer and not 7Zip.

Again, it's possible...not definitive. So...maybe.


It seems to me like that might (maybe) provide "other" or "previous" times the file was opened, but no actual way to be sure that it was the penultimate time.

jaclaz
_________________
- In theory there is no difference between theory and practice, but in practice there is. - 
 
  

keydet89
Senior Member
 

Re: penulatimate date

Post Posted: Oct 18, 19 17:48

- jaclaz

It seems to me like that might (maybe) provide "other" or "previous" times the file was opened, but no actual way to be sure that it was the penultimate time.


Again, it's possible...not definitive. So...maybe.  
 

Page 1 of 2
Page 1, 2  Next