File creation Date
Results 1 to 10 of 10

Thread: File creation Date

  1. #1
    Junior Member
    Join Date
    Dec 2003
    Posts
    3

    File creation Date

    Hi, this was a question brought up at my college where I am doing my Bcs. I am not a hacker but really interested in if its possible or how it works...Ok now to the question...

    If I backdate the bios and o/s date (WinXP) and create a word document and bring the date to todays date...is there any way that anyone can find out the file was created/ Modified on the previous date or today.

  2. #2
    Member
    Join Date
    Dec 2003
    Posts
    59
    U need to delete one of your threads...

    http://www.antionline.com/showthread...hreadid=252659

    What are you trying to achieve in this grand scheme of turning back the clock?

  3. #3
    Junior Member
    Join Date
    Dec 2003
    Posts
    3
    Well the puspose is that lets say a person has to submit a document to the faculty which was supposed to be handed in two months ago. Now if I create the document now and the file is checked by a computer expert....will he be able to tell that I made the document today and not a month or two ago.

  4. #4
    Disgruntled Postal Worker fourdc's Avatar
    Join Date
    Jul 2002
    Location
    Vermont, USA
    Posts
    797
    If you submit electronically, the document my have a created date reflecting when your misadjusted computer date/time; however their computer will jow when it was received.

    If you submit hardcopy, why even worry about the date.
    ddddc

    "Somehow saying I told you so just doesn't cover it" Will Smith in I, Robot

  5. #5
    Senior Member
    Join Date
    Oct 2003
    Posts
    234
    You could just create a small Windows program that uses the SetFileTime API function to change the date.

    http://antionline.com/showthread.php?s=&threadid=249638

  6. #6
    AO übergeek phishphreek's Avatar
    Join Date
    Jan 2002
    Posts
    4,325
    The time and date would read whatever you set the system clock to. As far as the OS is concerned... that IS the time and day that the file was created.

    You can disable the changing of the system clock in the bios by setting a password. Sure, it can be cleared... with little work.

    If you are using 2k or xp, you can restrict who can change what via group policy.

    I'm sure its possible to audit and log in the event log when people try or do change the system time. It will be a bit harder to audit the bios... so password protect the bios from changes and put a lock on the box.

    for local group policy >> click start >> run >>type gpedit.msc >>click OK>>
    expand computer configuration >> expand windows settings >>expand security settings >> expand local policies >>
    click on user rights assignment >> change the system time

    If this is a domain you would open AD users and computers >>right click your domain >> properies >> group policy >>
    edit >> expand computer configuration >> expand windows settings >>expand security settings >> expand local policies >>
    click on user rights assignment >> change the system time

    Source


    Its is also possible to change time/date stamps using software, rather than tweaking the clocks... google turns up quite a few results. AttributeMagic Pro is an example. See their claims here.

    As far as your main question... I would say no. Just because that IS the time and date that the file was created. How is it to know otherwise?

    Anyone else agree? Disagree?
    Quitmzilla is a firefox extension that gives you stats on how long you have quit smoking, how much money you\'ve saved, how much you haven\'t smoked and recent milestones. Very helpful for people who quit smoking and used to smoke at their computers... Helps out with the urges.

  7. #7
    AO Curmudgeon rcgreen's Avatar
    Join Date
    Nov 2001
    Posts
    2,716
    You don't need to mess with the BIOS or the OS dates. There is a utility called
    "touch", common in unix, probably also ported to windows, and it will set file dates
    any way you want. You should also research whether some document types
    may have the information embedded in them. The file dates are a function
    of the file system. Some systems will set today's date on any file you upload, so
    anything you do trying to prove the file was created earlier may be lost when
    it gets copied.
    I came in to the world with nothing. I still have most of it.

  8. #8
    AO French Antique News Whore
    Join Date
    Aug 2001
    Posts
    2,126
    Their is a program lurking on this board (As Attachement( that allow you to change the creation date from the 15th Century I think... I remember seing it but finding it it harder..
    -Simon \"SDK\"

  9. #9
    Antionline Herpetologist
    Join Date
    Aug 2001
    Posts
    1,165
    AFAIK, touch only sets a file to the current date and time.
    Cheers,
    cgkanchi
    Buy the Snakes of India book, support research and education (sorry the website has been discontinued)
    My blog: http://biology000.blogspot.com

  10. #10
    AO Curmudgeon rcgreen's Avatar
    Join Date
    Nov 2001
    Posts
    2,716
    Code:
    C:\junk>touch --help
    Usage: C:\WINDOWS\COMMAND\UNIX\TOUCH.EXE [OPTION]... FILE...
    Update the access and modification times of each FILE to the current time.
    
      -a                     change only the access time
      -c                     do not create any files
      -d, --date=STRING      parse STRING and use it instead of current time
      -f                     (ignored)
      -m                     change only the modification time
      -r, --reference=FILE   use this file's times instead of current time
      -t STAMP               use MMDDhhmm[[CC]YY][.ss] instead of current time
          --time=WORD        access -a, atime -a, mtime -m, modify -m, use -a
          --help             display this help and exit
          --version          output version information and exit
    
    STAMP may be used without -t if none of -drt, nor --, are used.


    http://unxutils.sourceforge.net/
    I came in to the world with nothing. I still have most of it.

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •