OVALProject/Sandbox — Issue #8: add support for querying the file name attribute on NTFS Volumes
Author: djhaynes
Created: 2012-03-05 14:09:48+00:00
State: open

Access to FILE NAME Attribute on NTFS volumes:
- Complicated by lack of APIs
- Single MFT entry may contain multiple FILE NAME Attributes
- Valuable for identifying potential time stamp tampering

Please see slide 7 of the slides attached to the following oval-developer-list post.

http://making-security-measurable.1364806.n2.nabble.com/Developer-Days-Artifact-Hunting-Slides-tp6463048p6463048.html