What does mactime, an essential part of the coroner’s t…

What does mactime, an essential part of the coroner’s toolkit do?

What does mactime, an essential part of the coroner’s toolkit do?

A.
It traverses the file system and produces a listing of all files based on the modification, access and change
timestamps

B.
It can recover deleted file space and search it for data. However, it does not allow the investigator to
preview them

C.
The tools scans for i-node information, which is used by other tools in the tool kit

D.
It is too specific to the MAC OS and forms a core component of the toolkit



Leave a Reply 0

Your email address will not be published. Required fields are marked *