File creation Date

[dingavinga]

Hi, this was a question brought up at my college where I am doing my Bcs. I am not a hacker but really interested in if its possible or how it works...Ok now to the question...

If I backdate the bios and o/s date (WinXP) and create a word document and bring the date to todays date...is there any way that anyone can find out the file was created/ Modified on the previous date or today.

[pR@nD1+Py]

U need to delete one of your threads...

http://www.antionline.com/showthread...hreadid=252659

What are you trying to achieve in this grand scheme of turning back the clock?

[dingavinga]

Well the puspose is that lets say a person has to submit a document to the faculty which was supposed to be handed in two months ago. Now if I create the document now and the file is checked by a computer expert....will he be able to tell that I made the document today and not a month or two ago.

[fourdc]

If you submit electronically, the document my have a created date reflecting when your misadjusted computer date/time; however their computer will jow when it was received.

If you submit hardcopy, why even worry about the date.

[TheRepublican]

You could just create a small Windows program that uses the SetFileTime API function to change the date.

http://antionline.com/showthread.php?s=&threadid=249638

[phishphreek]

The time and date would read whatever you set the system clock to. As far as the OS is concerned... that IS the time and day that the file was created.

You can disable the changing of the system clock in the bios by setting a password. Sure, it can be cleared... with little work.

If you are using 2k or xp, you can restrict who can change what via group policy.

I'm sure its possible to audit and log in the event log when people try or do change the system time. It will be a bit harder to audit the bios... so password protect the bios from changes and put a lock on the box.

for local group policy >> click start >> run >>type gpedit.msc >>click OK>>
expand computer configuration >> expand windows settings >>expand security settings >> expand local policies >>
click on user rights assignment >> change the system time

If this is a domain you would open AD users and computers >>right click your domain >> properies >> group policy >>
edit >> expand computer configuration >> expand windows settings >>expand security settings >> expand local policies >>
click on user rights assignment >> change the system time

Source

Its is also possible to change time/date stamps using software, rather than tweaking the clocks... google turns up quite a few results. AttributeMagic Pro is an example. See their claims here.

As far as your main question... I would say no. Just because that IS the time and date that the file was created. How is it to know otherwise?

Anyone else agree? Disagree?

[rcgreen]

You don't need to mess with the BIOS or the OS dates. There is a utility called
"touch", common in unix, probably also ported to windows, and it will set file dates
any way you want. You should also research whether some document types
may have the information embedded in them. The file dates are a function
of the file system. Some systems will set today's date on any file you upload, so
anything you do trying to prove the file was created earlier may be lost when
it gets copied.

[SDK]

Their is a program lurking on this board (As Attachement( that allow you to change the creation date from the 15th Century I think... I remember seing it but finding it it harder..

[cgkanchi]

AFAIK, touch only sets a file to the current date and time.
Cheers,
cgkanchi

[rcgreen]

C:\junk>touch --help
Usage: C:\WINDOWS\COMMAND\UNIX\TOUCH.EXE [OPTION]... FILE...
Update the access and modification times of each FILE to the current time.

  -a                     change only the access time
  -c                     do not create any files
  -d, --date=STRING      parse STRING and use it instead of current time
  -f                     (ignored)
  -m                     change only the modification time
  -r, --reference=FILE   use this file's times instead of current time
  -t STAMP               use MMDDhhmm[[CC]YY][.ss] instead of current time
      --time=WORD        access -a, atime -a, mtime -m, modify -m, use -a
      --help             display this help and exit
      --version          output version information and exit

STAMP may be used without -t if none of -drt, nor --, are used.

http://unxutils.sourceforge.net/