-----Original Message-----
From: Valdis.Kletnieks@vt.edu [mailto:Valdis.Kletnieks@vt.edu]
Sent: Monday, September 27, 2004 10:39 AM
To: Brian May
Cc: forensics@securityfocus.com
Subject: Re: Forensic Copy of Files off a CD...
On Fri, 24 Sep 2004 17:31:19 PDT, Brian May said:
I've noticed that when files are cloned off of a CD, the Date Last
Accessed is empty, so when the file is copied to the harddrive,
the Date Last Accessed gets set to the system time. Out of
curiosity, how would you handle this? I've tried to set the
dates of the file to null or empty, but that fails. I've tossed
around the idea of just setting the last access date to the date
last modified or created date (whichever is newer). Thanks in
advance...
"system time" seems as reasonable as anything - while it's on
the CD, it of course *cant* update the 'last access' time.
And when you copy it to a hard drive, the 'last access' to
*THAT* copy is, of course, the write access done
by the copy (at least until you look at it...)
As far as forensics go, pretending that you know *anything*
about the last access time of a file on a CD would be deceitful
at best - so it's probably *best* that you don't even pretend
to do a 'fixup' of that field. If that field is set
to "the time you were doing forensics", then you *know* it's
a bogus datum as far as forensics go - if you fix up the time
to "3 months, 17 days ago" because that's the "last modified"
date, you're looking at setting yourself up to make errors...
Which is one reason why I asked the question to the list, I'd
rather not taint the data. I'm still learning the art of forensics
and keeping data forensically sound.
-----------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management
and tracking system please see: http://aris.securityfocus.com
