Unresolved SIDs appear as long strings, such as S-1-5-21-3624371015-3360199248-30038020-3220, rather than human-readable names like SYSTEM, Network Service, or JohnSmith. If you look at the permissions on a file (on the Security tab), unresolved SIDs may appear. The only other method is checking for foreign SIDs on file/folder ACLs. In addition, any auditing for failed/successful attempts to access files would be recorded in the Security log on his computer. Your friend could copy any file(s), and I would not expect the "last access" date to change. Time is not updated on NTFS volumes by default. NTFS also permits last access time updates to be disabled. When a file is accessed or changed, either the OS or the application can update its "last write" or "last access" property. By default, there will be no record of such activity.
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |