rowingdude / analyzeMFT

MIT License
423 stars 117 forks source link

Update anomaly detection #44

Open dkovar opened 7 years ago

dkovar commented 7 years ago

Update anomaly detection to ONLY compare $StandardInfo and $Filename creation timestamps (it currently flags any timestamp anomaly between the two types of timestamps) -- their are too many reasons for the others to be off. But there is ONLY 1 time the creation timestamp is modified in both -- when teh file is created. If the two are different -- it is really weird. But we should have it ONLY focus on "CREATION" time to limit the massive amount of information.