Open piranna opened 6 years ago
At FILE_DENTRY_T they are being added the fields create_time_ms, modify_time_ms, access_time_ms and reserved2, but according to https://www.sans.org/reading-room/whitepapers/forensics/reverse-engineering-microsoft-exfat-file-system-33274, final implementation done by Microsoft replaced access_time_ms and two bytes from reserved2 as timezones for create, modify and access times. Probably should they be changed?
create_time_ms
modify_time_ms
access_time_ms
reserved2
At FILE_DENTRY_T they are being added the fields
create_time_ms,modify_time_ms,access_time_msandreserved2, but according to https://www.sans.org/reading-room/whitepapers/forensics/reverse-engineering-microsoft-exfat-file-system-33274, final implementation done by Microsoft replacedaccess_time_msand two bytes fromreserved2as timezones for create, modify and access times. Probably should they be changed?