When examining a victim machine forensically, one of the first things you can do is to look for files that have been recently altered. It could give you clues as to where an attacker was looking, what settings they modified, or what their motive was.
However, if an investigator is looking through an attacker's machine, then the goal is slightly different. Recently accessed files may give clues as to what tools they were using to attack where they might be hiding data, or what software they use.
The following example will search a directory and subdirectories to find all the files and sort them by the last modified time. This example is very much like the previous one except that the sorting is done by comparing ...
