public static ForensicTimeline[] Get(FileRecord input)
{
List<ForensicTimeline> macs = new List<ForensicTimeline>();
if (input.SequenceNumber != 0)
{
#region DetermineTime
Dictionary<DateTime, ACTIVITY_TYPE> dictionary = new Dictionary<DateTime, ACTIVITY_TYPE>();
// Modified Time
dictionary[input.ModifiedTime] = ACTIVITY_TYPE.m;
// Access Time
if (dictionary.ContainsKey(input.AccessedTime))
{
dictionary[input.AccessedTime] = dictionary[input.AccessedTime] | ACTIVITY_TYPE.a;
}
else
{
dictionary.Add(input.AccessedTime, ACTIVITY_TYPE.a);
}
// MFT Changed Time
if (dictionary.ContainsKey(input.ChangedTime))
{
dictionary[input.ChangedTime] = dictionary[input.ChangedTime] | ACTIVITY_TYPE.c;
}
else
{
dictionary.Add(input.ChangedTime, ACTIVITY_TYPE.c);
}
// Born Time
if (dictionary.ContainsKey(input.BornTime))
{
dictionary[input.BornTime] = dictionary[input.BornTime] | ACTIVITY_TYPE.b;
}
else
{
dictionary.Add(input.BornTime, ACTIVITY_TYPE.b);
}
#endregion DetermineTime
foreach (var time in dictionary)
{
string activity = ToFriendlyString(time.Value);
macs.Add(new ForensicTimeline(time.Key, activity, "MFT", "", input.FullName, input.ToString()));
}
return macs.ToArray();
}
else
{
macs.Add(new ForensicTimeline(new DateTime(1), "MACB", "MFT", "", "", ""));
return macs.ToArray();
}
}
