Not sure how to do this in a performant manner. But, would be nice to have the FN timestamps along with the SI timestamps. Then a simple hunt could be created to tag any file where suspected time stomping has occurred.
Not sure how to do this in a performant manner.
But, would be nice to have the FN timestamps along with the SI timestamps.
Then a simple hunt could be created to tag any file where suspected time stomping has occurred.