Add Date Stamp Support for Local Files/Archives

Date Stamps are not added to the Autopsy database for local file data sources. I believe the inclusion or exclusion of date stamps for logical files should be, at the very least, optional. It should be left to the examiner to interpret dates.

Legal processes (court order, consent, etc) are almost always limit the scope by time frame, and a lack of dates makes analysis difficult.

I realize that Windows was in view here when this decision was made, but Autopsy has a unique advantage that is being dismissed: Autopys runs on Linux and Linux can mount more file systems than any commercial or open source forensics tool.

Use case: F2FS

Under Linux, F2FS can be mounted read only and Autopsy can use the mount point as a Data Source to analyze logical files. However, Autopsy adds no dates.

A TAR archive made from the mount point may seem like a solution, but ingesting the TAR file only results in modified dates being added to the Autopsy database. All MAC times should be added from archives. Also, the archive becomes a bottleneck during ingest, so this is not a reasonable solution.

Hopefully my point is understood, but if not, I am happy to discuss further.

Thank you for your efforts in creating this tool and sharing it with the community.

Same suggestion, including Logical files.
In my view, Autospy could report the file dates, and using it depends on the job.