Printable View
I got a call from an investigator doing a Limewire investigation. The Limewire part doesn't matter so much as the OS being Vista. He has files showing the same Date Created and Last Accessed, but a more recent Date Modified. As far as we can tell, the files have not been moved or changed.
We just need to explain why/how a file can be modified without being accessed.
Any thoughts?
Just a thought.. Lot of AV's have an option of keeping original time stamp (accessed because they will access the file to scan it).. I am sure there are software's out there that let you change time stams the way you want..
I have dealt with a similar case on Vista (enterprise, shouldn’t matter though) and during my course of researching the only way a file will have a newer modified time (or uneven time stamps) is if the file is moved from different machine.
You can confirm this by checking owner / creator of the file that way at least you can see if it’s by the same user at least.
Hope this helps.. I'll put in something once i get time to look around.. on my way to home from office.. :)
The reason i'm focusing on time stamps is becuase they are the weak key here.
I am sure you can access the file and edit it through live CD without the host OS knowing about it..
What if the file was changed and time stamps reverted or something..
EDIT :
Lot of software's out there to let you change the time stamp of the file to what you want
http://www.codeproject.com/KB/files/timestamp.aspx
http://www.lifespy.com/2007/windows-...le-timestamps/
*I'm, maybe off the point here; for that please forgive me.. LONG WEEKEND AT WORK :x"
Thanks for the help, BW!
I think that's probably the caseQuote:
Originally Posted by ByTeWrangler
Single UserQuote:
I have dealt with a similar case on Vista (enterprise, shouldn’t matter though) and during my course of researching the only way a file will have a newer modified time (or uneven time stamps) is if the file is moved from different machine.
You can confirm this by checking owner / creator of the file that way at least you can see if it’s by the same user at least.
We're pretty sure is was not done intentionally.Quote:
I am sure you can access the file and edit it through live CD without the host OS knowing about it..
What if the file was changed and time stamps reverted or something..
EDIT :
Lot of software's out there to let you change the time stamp of the file to what you want
http://www.codeproject.com/KB/files/timestamp.aspx
http://www.lifespy.com/2007/windows-...le-timestamps/
*I'm, maybe off the point here; for that please forgive me.. LONG WEEKEND AT WORK :x"
Hi there BB,
Please check:
HKLM\SYSTEM\CurrentControlSet\Control\FileSystem\
NtfsDisableLastAccessUpdate
I think it is set to disable by default in Vista? which I believe prevents the last access date being updated. I have heard that it is supposed to improve performance.
ByTe is quite correct that there are quite a few utilities that allow you to alter file dates, including, I believe, some anti-forensics applications :eek:
Thanks, Nihil... I'll have him check that.
BTW, we don't talk about anti-forensics applications. ;)
/shudder
Hi,
That sounds like the Vista default. It will set the last accessed timestamp when the file is created or if it is copied. I also believe that moving a file will do it in some versions of Windows but I am not sure about Vista.Quote:
He has files showing the same Date Created and Last Accessed, but a more recent Date Modified.
The reason I mentioned anti-forensics is that I was thinking of "TimeStomp". However, I would have thought that if a perp knew about that application they would know to make the timestamps plausible and misleading? ;)