Epoch Time
Epochtime is a system for describing a point in time, defined as an approximation of the number of seconds that have elapsed since 00:00:00 Coordinated Universal Time (UTC).Epoch
an epoch is an instant in time chosen as the origin of a particular era. The "epoch" then serves as a reference point from which time is measuredTimestamp
A timestamp is a sequence of characters or encoded information identifying when a certain event occurred, usually giving date and time of day, sometimes accurate to a small fraction of a second.Beberapa definisi terkait MCA pada timestamp.
Carrier (2006)
- Creation Time (C) : This is the time the file was created.
- Modified Time (M) : This is the time that the contents attributes are modified.
- MFT modified Time (B) : Time that the metadata of the file was last modified (NTFS) and is not showing in Windows under Properties.
- Accessed Time (A) : Last time that the content of a file is opened.
Lee (2015)
- Metadata change Time (C) : Time the MFT Record was last modified.
- Data Content Change Time (M) : Time Data content of a file was last modified.
- Metadata Creation Time (B) : File was created in the volume/directory.
- Accessed Time (A) : Approximate time file data was last accessed
Kesimpulan
Epochtime merupakan timestamp pada sistem operasi unix sedangkan timestamp pada sistem operasi windows.... jadi untuk sistem operasi mac disebut apa ?Modified Time adalah waktu disaat merubah atau memodifikasi sebuah file / kapan file dimodifikasi atau dirubah
Created Time adalah waktu disaat membuat sebuah file / waktu kapan file itu dibuat
Accessed Time adalah waktu disaat sebuah file diakses / dibuka
Untuk merubah attribute dari MCA bisa menggunakan
aplikasi Attribute Changer
Source
https://en.wikipedia.org/wiki/Epoch_(reference_date)https://en.wikipedia.org/wiki/Unix_time
https://en.wikipedia.org/wiki/Timestamp
https://www.sans.org/reading-room/whitepapers/forensics/filesystem-timestamps-tick-36842
Tidak ada komentar