Does anyone know what this second entry translates to in #linux #ext4 debugfs stat output? The preceding 0x... is the hex representation of a epoch seconds timestamp. But, scratching my head on the second entry. 馃 Included stat output for ref. Maybe @hal_pomeranz knows? #DFIR
This is what I get for ignoring Twitter over the weekend...

Jan 15, 2018 路 7:07 AM UTC

1
1
Replying to @hal_pomeranz
Yep, you get people that have been empowered to answer their own questions based on your great contributions to the community. You should be proud!
1
My DFIRSummit research is going to be the same sort of deep dive into XFS.