Week 1: Discussion – Key File and File System Attributes

During this first discussion, I would like you to think like a forensic examiner. What key attributes would you like to know about a file you need to examine?

When examining files and file systems key attributes are collected.  For example:

File Location
File Size
File Timestamps

For this , please define and discuss one filesystem or file attribute that you find critically important during an investigation.  Define the attribute, explain why you believe it is critical, and what inculpatory or exculpatory evidence it can provide.