Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Additional rules #46

Closed
dkovar opened this issue Apr 27, 2017 · 0 comments
Closed

Additional rules #46

dkovar opened this issue Apr 27, 2017 · 0 comments
Assignees
@rowingdude
Labels
enhancement question Standard_Addition

Comments

@dkovar
Copy link
Contributor

dkovar commented Apr 27, 2017

M - modified, B - birth, A - accessed:

If M < B then likely file copy Detected at B
If M and B < A == volume file move
noahrubin pushed a commit to analyzeDFIR/analyzeMFT that referenced this issue Aug 12, 2017
Issue rowingdude#46: Additional Rules - implement likely_copy and lik…
bee62c8 
…ely_move
@mpilking mpilking mentioned this issue Mar 8, 2018
Merged
@rowingdude rowingdude self-assigned this Aug 1, 2024
rowingdude added a commit that referenced this issue Sep 4, 2024
@rowingdude
Adds body file, timeline, l2t back. Closes Files not marked as delete…
cef6594 
…d in bodyfile output #33 Data run calculations are wrong? #21 Investigate update sequence numbers #9 Datarun oddity #16 Additional rules #46
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@rowingdude rowingdude

Labels
enhancement question Standard_Addition
Projects
AnalyzeMFT
Status: Done
Milestone
No milestone
Development

No branches or pull requests
2 participants
@dkovar @rowingdude