Deviation from implementation
piranna opened this issue · comments
Jesús Leganés-Combarro commented
At FILE_DENTRY_T they are being added the fields create_time_ms
, modify_time_ms
, access_time_ms
and reserved2
, but according to https://www.sans.org/reading-room/whitepapers/forensics/reverse-engineering-microsoft-exfat-file-system-33274, final implementation done by Microsoft replaced access_time_ms
and two bytes from reserved2
as timezones for create, modify and access times. Probably should they be changed?