Reading...
Play button
Play button
Use LEFT and RIGHT arrow keys to navigate between flashcards;
Use UP and DOWN arrow keys to flip the card;
H to show hint;
A reads text to speech;
8 Cards in this Set
- Front
- Back
|
File Name
|
The File Name is the name of the file in the evidence file. The icon next to the file indicates the status.
|
|
|
Short Name
|
The Short Name is the 8.3 DOS-convention name that Windows gives the file.
|
|
|
File Ext
|
The file’s extension as recorded by the operating system. Renamed extentions will be displayed.
|
|
|
Description
|
A short description or explanation of what the icon to the left of the file name is.
|
|
|
Deleted
|
A date and time will be in this column if this file has been deleted, but not yet emptied from the Recycle Bin.
|
|
|
Last Accessed
|
Last accessed date of the file. A file may be accessed without altering any data. Viewing, dragging, right-clicking virus scans etc. will change the Last Accessed date.
|
|
|
Last Written
|
The last date and time that a file was actually opened, edited, then saved. If a file is merely opened then closed or edited, and closed with no save, this column will not update.
|
|
|
File Created
|
The File Created date / time stamp is a record of when that particular file was created at that location. If a file is edited and changed on January third, then copied to a floppy diskette on January 15th, and then that floppy diskette acquired on January 28th, EnCase would show that the file (on the floppy) was created after it was last written or even accessed.
|
