"Potter, Timothy" <Timothy.F.Potter@pjc.com> 11/10/2004 8:29:38 AM
If mactimes can easily be modified by a hacker, then would I know, and
how
would mactimes be utilized in court?
I have a Microsoft Excel file on a fat12 floppy disk.
Here are the mactimes:
modified: 9/28/2004 @ 9:12AM CST
accessed: 9/29/2004 @ 4:38PM CST
created: 10/1/2004 @ 1:12 AM
So, how can the created time be later than the last modified time??
This
doesn't help in establishing a clear timeline of events.. Thanks,
-Tim
When Windows makes a copy of a file, if the Modified time is available,
it duplicates that data -- because the file hasn't been "modified", per
se. The file was created, but nothing was changed within it.
For example, I have:
C:\WINNT\KB329115.log
Created: November 17, 2003, 10:39:37
Modified: November 17, 2003, 10:39:48
Accessed: November 11, 2004, 12:10:06
I made a copy of it to the same folder:
C:\WINNT\Copy of KB329115.log
Created: November 11, 2004, 12:10:20
Modified: November 17, 2003, 10:39:48
Accessed: November 11, 2004, 12:10:20
So the file has not been "modified", strictly speaking. It was just
duplicated. But that is Windows. A quick check on my Linux machine
shows that using cp, without options, to duplicate a file resets both
the created and modified times:
cp samba-2.2.12.tar.gz copy-of-samba-2.2.12.tar.gz
samba-2.2.12.tar.gz
Created: October 26, 2004, 14:20
Modified: September 29, 2004, 06:51
copy-of-samba-2.2.12.tar.gz
Created: November 11, 2004, 12:17
Modified: November 11, 2004, 12:17
It loses the previous times. But if I copy the file with the -p
switch, I get different results:
cp -p samba-2.2.12.tar.gz copy-of-samba-2.2.12.tar.gz
samba-2.2.12.tar.gz
Created: October 26, 2004, 14:20
Modified: September 29, 2004, 06:51
copy-of-samba-2.2.12.tar.gz
Created: November 11, 2004, 12:18
Modified: September 29, 2004, 06:51
Under Windows, if you create a new file, then I think it's possible for
it to not have a modified time. I've seen files with just a Created
time. I don't believe that's the same under Linux/UNIX.
So for Windows, copying a file will set the times as shown. Under
Linux/UNIX, the results depend on how the person did it.
Matt
-----------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management
and tracking system please see: http://aris.securityfocus.com
