±Partners and Sponsors

±Your Account


Nickname
Password


Forgotten password/username?


Membership:
New Today: 0
New Yesterday: 3
Overall: 26796
Visitors: 53

±Follow Forensic Focus

Join our LinkedIn group

Subscribe to news

Subscribe to forums

Subscribe to blog

Subscribe to tweets

File creation date - Windows XP

Forensic software discussion (commercial and open source/freeware). Strictly no advertising.
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
Go to page 1, 2  Next 
  

File creation date - Windows XP

Post Posted: Sun Feb 24, 2013 12:28 pm

HI everybody,

I'm new at foresincs. I made a dd image of a disk drive and opened it in my computer with autopsy. I want to verify the creation date of some files. The issue is that it is not the same date that was supposed to be. The question is: if I cut and paste a file in windows xp, is the creation data of the file modified?

Thanks in advance.  

Chisco77
Newbie
 
 
  

Re: File creation date - Windows XP

Post Posted: Sun Feb 24, 2013 1:10 pm

The creation date is the date and time the file is created on the media - it is not related to the modified date
_________________
Michael Cotgrove
www.cnwrecovery.com
cnwrecovery.blogspot.com/ 

mscotgrove
Senior Member
 
 
  

Re: File creation date - Windows XP

Post Posted: Sun Feb 24, 2013 2:25 pm

Hi,

I now creation date is the date the file "landed" on the device. The question is: if I move a file on windows Xp, is the creation data altered? And, most important, can I assume that if modification date is before creation date, the file was copied from another location and wasn't created in that filesystem?  

Chisco77
Newbie
 
 
  

Re: File creation date - Windows XP

Post Posted: Sun Feb 24, 2013 2:34 pm

The best answer to your question is to try it.

Working on tests and seeing the results will mean you will understand how dates get applied and used.
_________________
Michael Cotgrove
www.cnwrecovery.com
cnwrecovery.blogspot.com/ 

mscotgrove
Senior Member
 
 
  

Re: File creation date - Windows XP

Post Posted: Sun Feb 24, 2013 4:07 pm

- Chisco77
The question is: if I cut and paste a file in windows xp, is the creation data of the file modified?


Sometimes when people say cut and paste, they mean copy and paste. A copied file in Win XP will not bear the creation date of the original. An actual cut and paste is equivalent to Move, which does maintain the creation date. (Edit: even across volumes.)

If the modification date precedes the creation date, you can assume that something unusual happened, i.e., that the file was not created and updated in place. There could be several causes: perhaps the clock changed, perhaps it was copied from another location, etc.

Quite often, when a file is copied from external media, the source file system is FAT, which has distinctly different timestamp characteristics from NTFS. For example, if the modification time is truncated to an even number of seconds, that's an indication it may have been copied from a FAT device such as a flash drive.
_________________
Scott Tucker
Aptegra Consulting, LLC
www.aptegra.com 

TuckerHST
Senior Member
 
 
  

Re: File creation date - Windows XP

Post Posted: Mon Feb 25, 2013 3:39 am

Tucker,

thanks for your answer. It confirms muy suspects. I tried and move, copied, cut &pasted a file in windows and creation date wasn't changed. Something else happenned to that file!  

Chisco77
Newbie
 
 
  

Re: File creation date - Windows XP

Post Posted: Mon Feb 25, 2013 12:15 pm

Here again with file creation date. If I go to right button-properties I see a different creation date in the general tag than in the details tab. It is an Autocad file. Why are there two creation dates?  

Chisco77
Newbie
 
 
Reply to topicReply to topic

Share this forum topic to encourage more replies



Page 1 of 2
Go to page 1, 2  Next