I've been testing access times today. This is not related to an active case, just curiosity.
I found that "robocopy /mir" and tar both modify the last access time. Also, on my Linux fileserver I use xfsdump to make my nightly backups and it modifies access times. I have not tested virus scanning or any other backup software yet. Does anyone know of a resource that describes what tools preserve access time. Thanks Greg -- Greg Freemyer The Norcross Group Forensics for the 21st Century
