PTK has been adapted to the latest version of the TSK 3.0. Among the main improvements have been:
- better management of the deleted files and orphaned files
- the distinction, at the time, including Modified Time, Access Time, Change Time and Time Birth
The second enhancement introduces new MACB concept thus providing more accurate information about the files stored on file NTFS. It shows a picture of PTK function in TSK 3.0.
remember that this new version of PTK will be available end of September unless a written request to the Team of PTK (ptk@dflabs.com) in order to contribute to the beta. Obviously the new version will contain many other additions and improvements.
0 comments:
Post a Comment