Modify filedate and time ($MFT) Log Out | Topics | Search
Moderators | Edit Profile

X-Ways Support Forum » Hex Editing » Modify filedate and time ($MFT) « Previous Next »

Author Message
Top of pagePrevious messageNext messageBottom of page Link to this message

Carlo
Username: locarbo

Registered: N/A
Posted on Tuesday, Sep 16, 2008 - 10:50:   
Hi,
I am a new user. With WinHex can I replace, into the MFT, the date of a group of file (deleted, lost, etc) with a certain date ?

Thanks,
Carlo
Top of pagePrevious messageNext messageBottom of page Link to this message

Stefan Fleischmann
Username: admin

Registered: 1-2001
Posted on Tuesday, Sep 16, 2008 - 11:10:   
With WinHex you can edit all the bits and bytes in disk sectors, yes, and that includes timestamps, yes. If you know where exactly the timestamp is stored, the data interpreter can convert a certain date and time to binary data and write it into the sector.
Top of pagePrevious messageNext messageBottom of page Link to this message

Carlo
Username: locarbo

Registered: N/A
Posted on Tuesday, Sep 16, 2008 - 11:57:   
An idea howto know where exactly the timestamp is stored ?

Thanks,
Top of pagePrevious messageNext messageBottom of page Link to this message

Stefan Fleischmann
Username: admin

Registered: 1-2001
Posted on Tuesday, Sep 16, 2008 - 13:00:   
Sure, but this is hardly something that I can explain right here. Just like if you buy a guitar in a shop, that doesn't mean that you will get playing lessons, too.

Add Your Message Here
Post:
Username: Posting Information:
Only registered users may post messages here, i.e. you need to have an account.
Password:
Options: Enable HTML code in message
Automatically activate URLs in message
Action:
Forum operated by X-Ways Software Technology AG.