Windows registry artifactNTFS LastAccess Timestamp Status
NTFS LastAccess Timestamp, 2147483650 = Enabled, 1 = Disabled
- System Info
- 1 key
SYSTEM
Registry keys
1 key that RECmd reads for this artifact
SYSTEMNtfsDisableLastAccessUpdateControlSet*\Control\FileSystemNTFS LastAccess Timestamp, 2147483650 = Enabled, 1 = Disabled
References
2 links
Source: RECmd/BatchExamples/DFIRBatch.reb(opens in new tab) v2.22 by Andrew Rathbun and contributors(opens in new tab), MIT License(opens in new tab)