# Add Date Stamp Support for Local Files/Archives

**URL:** <https://sleuthkit.discourse.group/t/add-date-stamp-support-for-local-files-archives/823>\
**Category:** Autopsy Feature Requests\
**Created:** [April 14, 2020, 4:25pm UTC](https://sleuthkit.discourse.group/t/add-date-stamp-support-for-local-files-archives/823 "2020-04-14T16:25:02Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![John\_Lehr](https://yyz2.discourse-cdn.com/free1/user_avatar/sleuthkit.discourse.group/john_lehr/32/45_2.png) [@John\_Lehr](https://sleuthkit.discourse.group/u/John_Lehr)\
**Post date:** [April 14, 2020, 4:25pm UTC](https://sleuthkit.discourse.group/t/add-date-stamp-support-for-local-files-archives/823/1 "2020-04-14T16:25:02Z")

</div>

Date Stamps are not added to the Autopsy database for local file data sources. I believe **the inclusion or exclusion of date stamps for logical files should be, at the very least, optional**. It should be left to the examiner to interpret dates.

Legal processes (court order, consent, etc) are almost always limit the scope by time frame, and a lack of dates makes analysis difficult.

I realize that Windows was in view here when this decision was made, but Autopsy has a unique advantage that is being dismissed: Autopys runs on Linux and Linux can mount more file systems than any commercial or open source forensics tool.

Use case: F2FS

Under Linux, F2FS can be mounted read only and Autopsy can use the mount point as a Data Source to analyze logical files. However, Autopsy adds no dates.

A TAR archive made from the mount point may seem like a solution, but ingesting the TAR file only results in modified dates being added to the Autopsy database. **All MAC times should be added from archives.** Also, the archive becomes a bottleneck during ingest, so this is not a reasonable solution.

Hopefully my point is understood, but if not, I am happy to discuss further.

**Thank you for your efforts in creating this tool and sharing it with the community.**

---

<div class="post-metadata">

**Author:** ![EmmanuelC](https://yyz2.discourse-cdn.com/free1/user_avatar/sleuthkit.discourse.group/emmanuelc/32/233_2.png) [@EmmanuelC](https://sleuthkit.discourse.group/u/EmmanuelC)\
**Post date:** [July 5, 2020, 9:21am UTC](https://sleuthkit.discourse.group/t/add-date-stamp-support-for-local-files-archives/823/2 "2020-07-05T09:21:40Z")

</div>

Same suggestion, including Logical files.  
In my view, Autospy could report the file dates, and using it depends on the job.  
Thanks!

---

<div class="post-metadata">

**Author:** ![Mark\_McKinnon](https://yyz2.discourse-cdn.com/free1/user_avatar/sleuthkit.discourse.group/mark_mckinnon/32/42_2.png) [@Mark\_McKinnon](https://sleuthkit.discourse.group/u/Mark_McKinnon)\
**Post date:** [August 1, 2023, 3:17pm UTC](https://sleuthkit.discourse.group/t/add-date-stamp-support-for-local-files-archives/823/3 "2023-08-01T15:17:43Z")

</div>

This will be in the next release 4.21.0
