-
December 23rd, 2003, 07:15 AM
#1
Junior Member
File creation Date
Hi, this was a question brought up at my college where I am doing my Bcs. I am not a hacker but really interested in if its possible or how it works...Ok now to the question...
If I backdate the bios and o/s date (WinXP) and create a word document and bring the date to todays date...is there any way that anyone can find out the file was created/ Modified on the previous date or today.
-
December 23rd, 2003, 07:19 AM
#2
Member
U need to delete one of your threads...
http://www.antionline.com/showthread...hreadid=252659
What are you trying to achieve in this grand scheme of turning back the clock?
-
December 23rd, 2003, 07:29 AM
#3
Junior Member
Well the puspose is that lets say a person has to submit a document to the faculty which was supposed to be handed in two months ago. Now if I create the document now and the file is checked by a computer expert....will he be able to tell that I made the document today and not a month or two ago.
-
December 23rd, 2003, 07:37 AM
#4
If you submit electronically, the document my have a created date reflecting when your misadjusted computer date/time; however their computer will jow when it was received.
If you submit hardcopy, why even worry about the date.
ddddc
"Somehow saying I told you so just doesn't cover it" Will Smith in I, Robot
-
December 23rd, 2003, 01:31 PM
#5
Senior Member
You could just create a small Windows program that uses the SetFileTime API function to change the date.
http://antionline.com/showthread.php?s=&threadid=249638
-
December 23rd, 2003, 02:53 PM
#6
The time and date would read whatever you set the system clock to. As far as the OS is concerned... that IS the time and day that the file was created.
You can disable the changing of the system clock in the bios by setting a password. Sure, it can be cleared... with little work.
If you are using 2k or xp, you can restrict who can change what via group policy.
I'm sure its possible to audit and log in the event log when people try or do change the system time. It will be a bit harder to audit the bios... so password protect the bios from changes and put a lock on the box.
for local group policy >> click start >> run >>type gpedit.msc >>click OK>>
expand computer configuration >> expand windows settings >>expand security settings >> expand local policies >>
click on user rights assignment >> change the system time
If this is a domain you would open AD users and computers >>right click your domain >> properies >> group policy >>
edit >> expand computer configuration >> expand windows settings >>expand security settings >> expand local policies >>
click on user rights assignment >> change the system time
Source
Its is also possible to change time/date stamps using software, rather than tweaking the clocks... google turns up quite a few results. AttributeMagic Pro is an example. See their claims here.
As far as your main question... I would say no. Just because that IS the time and date that the file was created. How is it to know otherwise?
Anyone else agree? Disagree?
Quitmzilla is a firefox extension that gives you stats on how long you have quit smoking, how much money you\'ve saved, how much you haven\'t smoked and recent milestones. Very helpful for people who quit smoking and used to smoke at their computers... Helps out with the urges.
-
December 23rd, 2003, 02:57 PM
#7
You don't need to mess with the BIOS or the OS dates. There is a utility called
"touch", common in unix, probably also ported to windows, and it will set file dates
any way you want. You should also research whether some document types
may have the information embedded in them. The file dates are a function
of the file system. Some systems will set today's date on any file you upload, so
anything you do trying to prove the file was created earlier may be lost when
it gets copied.
I came in to the world with nothing. I still have most of it.
-
December 23rd, 2003, 03:21 PM
#8
Their is a program lurking on this board (As Attachement( that allow you to change the creation date from the 15th Century I think... I remember seing it but finding it it harder..
-
December 23rd, 2003, 06:28 PM
#9
AFAIK, touch only sets a file to the current date and time.
Cheers,
cgkanchi
-
December 24th, 2003, 04:54 AM
#10
Code:
C:\junk>touch --help
Usage: C:\WINDOWS\COMMAND\UNIX\TOUCH.EXE [OPTION]... FILE...
Update the access and modification times of each FILE to the current time.
-a change only the access time
-c do not create any files
-d, --date=STRING parse STRING and use it instead of current time
-f (ignored)
-m change only the modification time
-r, --reference=FILE use this file's times instead of current time
-t STAMP use MMDDhhmm[[CC]YY][.ss] instead of current time
--time=WORD access -a, atime -a, mtime -m, modify -m, use -a
--help display this help and exit
--version output version information and exit
STAMP may be used without -t if none of -drt, nor --, are used.
http://unxutils.sourceforge.net/
I came in to the world with nothing. I still have most of it.
Posting Permissions
- You may not post new threads
- You may not post replies
- You may not post attachments
- You may not edit your posts
-
Forum Rules
|
|