Re: Date on ntuser.dat.LOG
- From: "germanshorthairpointer@xxxxxxxxx" <germanshorthairpointer@xxxxxxxxx>
- Date: 5 Sep 2006 15:11:22 -0700
I should have been more direct with my question. Basically, I'm
looking into a scenario where someone might be accused of logging into
a machine based on the date modified of the ntuser.dat.log file located
in a users profile. The following link shows where someone asked a
question on the respective topic.
http://www.tek-tips.com/viewthread.cfm?qid=1266106&page=1 I'll post it
here for simplicity also.
------------------
I was wrongly accused to have logged on a PC yesterday, and as proof,
they exhibited my profile that appeared in the C:\Documents and
Settings\my username.
I did logon to that PC 2 months ago, which i don't deny, as show the
local settings, the desktop, my documents, etc... with the date of 2
months ago when i first and ONLY TIME logged on to that PC.
However, i NEVER logged onto that PC yesterday, nevertheless, there is
a NTUSER.DAT.LOG txt in my profile on that PC, with the date of
yesterday !!!!
-------------------
Basically, I know its not good evidence, but I want to know why its
happening... Why or how could the date modified attribute be changed
w/out a user logging in?
Thanks for your help!
.
- Follow-Ups:
- Re: Date on ntuser.dat.LOG
- From: Wesley Vogel
- Re: Date on ntuser.dat.LOG
- References:
- Date on ntuser.dat.LOG
- From: germanshorthairpointer@xxxxxxxxx
- Re: Date on ntuser.dat.LOG
- From: Wesley Vogel
- Date on ntuser.dat.LOG
- Prev by Date: Re: Date on ntuser.dat.LOG
- Next by Date: Re: Windows encryption
- Previous by thread: Re: Date on ntuser.dat.LOG
- Next by thread: Re: Date on ntuser.dat.LOG
- Index(es):
Relevant Pages
|