Lazza / RecuperaBit

A tool for forensic file system reconstruction.
GNU General Public License v3.0
517 stars 73 forks source link

Restore modification time if possible #104

Closed slavanap closed 9 months ago

slavanap commented 2 years ago

Use $STANDARD_INFORMATION for modification time because only it is preserved on file copy. Reference: https://www.forensixchange.com/posts/19_04_22_win10_ntfs_time_rules/

My fix may not be the best, because I haven't read full code base, but it allowed me to restore photos with correct modification time on them (file capture time) which have been copied onto the damaged drive. So, let's discuss if I didn't catch something.