27.9k views
3 votes
When analyzing a timestamp for timestomping what two NTFS attributes should you compare?

User Romac
by
8.0k points

1 Answer

4 votes

Final answer:

When analyzing a timestamp for timestomping, you should compare the Standard Information attribute and the File Name attribute in the NTFS file system.

Step-by-step explanation:

When analyzing a timestamp for timestomping, you should compare the Standard Information attribute and the File Name attribute in the NTFS file system.

User Nickofthyme
by
8.9k points