1 Answers

What does mactime, an essential part of the coroner’s toolkit do?

Asked by: 69 views ,
EC0-349

What does mactime, an essential part of the coroner’s toolkit do?

A.
It is a tool specific to the MAC OS and forms a core component of the toolkit

B.
It traverses the file system and produces a listing of all files based on the modification, access and change timestamps

C.
The toolsscans for i-node information, which is used by other tools in the tool kit

D.
It can recover deleted file space and search it for data. However, it does not allow the investigator to preview them

1 Answers



  1. Enkmin on Oct 06, 2012 Reply

    Answers: B
    _ It traverses the file system and produces a listing of all files based on the modification, access and change timestamps

    0 Votes Thumb up 0 Votes Thumb down 0 Votes