Testing the Date Maintenance of the File Allocation Table File System
Tom Waghorn · 2003
The directory entries used in the File Allocation Table filesystems maintain a significant amount of file metadata that is of interest to a forensic examiner. This information is maintained by the operating system under normal conditions and may be amended by activities undertaken by the computer user. This paper examines the maintenance of date information when files are being moved between different versions of the FAT filesystem