Difference between revisions of "Type UTMP"
Jump to navigation
Jump to search
| (4 intermediate revisions by the same user not shown) | |||
| Line 1: | Line 1: | ||
{| style="float:right;border:1px solid black" | {| style="float:right;border:1px solid black" | ||
| − | |+ Details | + | |+ [[Type_Google_Drive_Snapshot|<<]] Details [[Type_Generic_Password_Dump|>>]] |
| Defined Constant | | Defined Constant | ||
| <code>Type_UTMP</code> | | <code>Type_UTMP</code> | ||
| Line 16: | Line 16: | ||
| No | | No | ||
|- | |- | ||
| − | | | + | | Carve Meta Data |
| Yes | | Yes | ||
|- | |- | ||
| Line 31: | Line 31: | ||
Records various unix system status items. | Records various unix system status items. | ||
| − | = | + | =Carve Meta Data= |
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
When Truxton carves this file, it can populate the following columns in the <code><nowiki>[</nowiki>[[File Table|File]]<nowiki>]</nowiki></code> table: | When Truxton carves this file, it can populate the following columns in the <code><nowiki>[</nowiki>[[File Table|File]]<nowiki>]</nowiki></code> table: | ||
* <code>Created</code> - When the file was created | * <code>Created</code> - When the file was created | ||
| − | * <code> | + | * <code>LastWrite</code> - When the file was last modified |
* <code>Name</code> - The name of the file | * <code>Name</code> - The name of the file | ||
| + | |||
| + | =Details= | ||
| + | * [https://en.wikipedia.org/wiki/Utmp Wikipedia] | ||
Latest revision as of 17:28, 21 May 2024
| Defined Constant | Type_UTMP
|
| File Type Value | 997 |
| Parent Type | None |
| Carve | Yes |
| Format Details | No |
| Carve Meta Data | Yes |
| MIME Type | application/octet-stream
|
| Filename Extension | utmp
|
UTMP
Description
Records various unix system status items.
Carve Meta Data
When Truxton carves this file, it can populate the following columns in the [File] table:
Created- When the file was createdLastWrite- When the file was last modifiedName- The name of the file
