Just my 2c but...
The file receives its original mactimes from the local system time on
the machine it was created on. If the file is then copied across the
network, by person or program, it will (depending on copy method)
maintain the original modification time from the first computer but get
the creation time from the new system. It is not uncommon for two
systems on a network to have a few seconds difference in their times.
I'm not entirely sure if the modification time could have come from the
original machine if it was saved directly to the second one; maybe
through the creation of a temp file before copying across the network- I
suppose it depends on how the particular software handles it.
A forensic image will maintain the original mactimes, as to do otherwise
would compromise the integrity of the capture. If called to prove that
the image has not been tampered with the sig of the original drive and
the image can be compared. Any changes at all will mess that up.
Anyway that may not help but there you go,
Joe
-----Original Message-----
From: K Pugh [mailto:kpughmisc@pughkilleen.com]
Sent: 27 January 2005 06:17
To: forensics@securityfocus.com
Subject: mactimes - a network question
In-Reply-To:
<1169300920-1100204291-cardhu_blackberry.rim.net-11901-@engine67>
I've got a question related to the mactimes discussion. I have searched
the web for an answer to this question, but I have not found anything.
I have a set of files on a hard drive that was produced from a forensic
image (from EnCase I believe).
In examining these files, the Modified Time is between 2 and 4 seconds
before the Created Time. Other files on the system appear to be normal.
By normal, I mean Modified Times after Creation Times or Creation Times
well after Modified Times, which is an indication of copying from
somewhere else.
Since Windows sets the Created Time when a file is copied, then these
files would have had to been copied within 2 to 8 seconds after they
were created. This does not seem to make any sense in terms of what the
user was doing at that time on the system.
Is this difference an artifact of the way EnCase creates a copy?
The computer in which the hard drive was located was on a network.
There is suspicion that the files were placed on this drive by another
drive on the network. If another computer placed these files there,
would either the Modified Time or Creation Time be relative to the other
computer. Or are the times relative to the computer on which they
reside?
Thanks.
Ken
Any number of programs that copy files will consider the new file to be
different from the old file, and reset the creation date/time.
EnCase does that when you do a copy from a forensic image. The idea
(remember, all software is just a bunch of ideas that passed through the
heads of programmers) is that the forensic analyst understands the value
of having a date/time stamp that shows the file copy action.
I've seen CD burning software, and copies from CD, produce the same end
result.
Regards,
Jason Coombs
jasonc@science.org
-----------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management
and tracking system please see: http://aris.securityfocus.com
-----------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management
and tracking system please see: http://aris.securityfocus.com
