Re: Forensic Copy of Files off a CD...

On Fri, 24 Sep 2004 17:31:19 PDT, Brian May said:

> I've noticed that when files are cloned off of a CD, the Date Last
> Accessed is empty, so when the file is copied to the harddrive, the Date
> Last Accessed gets set to the system time.  Out of couriosity, how would
> you handle this?  I've tried to set the dates of the file to null or
> empty, but that fails.  I've tossed around the idea of just setting the
> last access date to the date last modified or created date (whichever is
> newer).  Thanks in advance...

"system time" seems as reasonable as anything - while it's on the CD, it of
course *cant* update the 'last access' time.  And when you copy it to a hard
drive, the 'last access' to *THAT* copy is, of course, the write access done
by the copy (at least until you look at it...)

As far as forensics go, pretending that you know *anything* about the last 
access
time of a file on a CD would be deceitful at best - so it's probably *best*
that you don't even pretend to do a 'fixup' of that field.  If that field is set
to "the time you were doing forensics", then you *know* it's a bogus datum as
far as forensics go - if you fix up the time to "3 months, 17 days ago"
because that's the "last modified" date, you're looking at setting yourself
up to make errors...

I'll overlook the fact that the last modified/create dates listed on the CD
are subject to being twiddled just before burning - there's no reason I can't
create a CD that has those dates set to 2 years before the invention of the
CD format....  So be careful in your interpretations... :)

pgpiQUOOJmLPS.pgp
Description: PGP signature