In-Reply-To: <1169300920-1100204291-cardhu_blackberry.rim.net-11901-@engine67>
I've got a question related to the mactimes discussion. I have searched the web
for an answer to this question, but I have not found anything.
I have a set of files on a hard drive that was produced from a forensic image
(from EnCase I believe).
In examining these files, the Modified Time is between 2 and 4 seconds before
the Created Time. Other files on the system appear to be normal. By normal, I
mean Modified Times after Creation Times or Creation Times well after Modified
Times, which is an indication of copying from somewhere else.
Since Windows sets the Created Time when a file is copied, then these files
would have had to been copied within 2 to 8 seconds after they were created.
This does not seem to make any sense in terms of what the user was doing at
that time on the system.
Is this difference an artifact of the way EnCase creates a copy?
The computer in which the hard drive was located was on a network. There is
suspicion that the files were placed on this drive by another drive on the
network. If another computer placed these files there, would either the
Modified Time or Creation Time be relative to the other computer. Or are the
times relative to the computer on which they reside?
Thanks.
Ken
Any number of programs that copy files will consider the new file to be
different from the old file, and reset the creation date/time.
EnCase does that when you do a copy from a forensic image. The idea (remember,
all software is just a bunch of ideas that passed through the heads of
programmers) is that the forensic analyst understands the value of having a
date/time stamp that shows the file copy action.
I've seen CD burning software, and copies from CD, produce the same end result.
Regards,
Jason Coombs
jasonc@science.org
-----------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management
and tracking system please see: http://aris.securityfocus.com
