[Dshield] Access Database Forensics

Hebert, John jhebert at putnamplastics.com
Wed Nov 23 12:27:01 GMT 2005


 

> -----Original Message-----
> From: list-bounces at lists.dshield.org 
> [mailto:list-bounces at lists.dshield.org] On Behalf Of Nemo Omen
> Sent: Tuesday, November 22, 2005 7:44 PM
> To: list at lists.dshield.org
> Subject: [Dshield] Access Database Forensics

<snip>

> I've been asked to see if I can find out when a certain 
> record was added to an Access Database.

</snip>

I'm not sure how detailed a timeframe you're looking for, but one option
would be to compare that record against older copies on backup tapes.
That should get you to the proper day at least.

For future reference, perhaps add a date/time field into the database
with a default value of 'Now()'.  Is it possible to go in and change it?
Yes, but for the less adept end users, it should at least give you some
visibility.

John



More information about the list mailing list