A: your opinions pl...
 
Notifications
Clear all

A: your opinions plz

3 Posts
3 Users
0 Likes
217 Views
(@armresl)
Posts: 1011
Noble Member
Topic starter
 

Hello,

I was curious what conclusion everyone would arrive at if they say this in an investigation.

In the recent folder

A:\reallysecretstuff.doc .lnk file

M 6/1/05
A 6/1/05
C 5/31/05

the actual file reallysecretstuff (please forgive the really cheesy name) woulld have times like

M 4/23/05
A 4/23/05
C 4/1/05

Would you think the file was recently copied from the hard drive to a floppy?

A copy from a floppy was recently viewed?

Thank you for your opinions, hope everyone has a good day.

 
Posted : 29/06/2005 2:36 pm
andy1500mac
(@andy1500mac)
Posts: 79
Trusted Member
 

Hi Armresl,

As anyone with more experience will attest to time stamps can be a dicey subject but from what you’ve provided I would think that the file was copied to floppy on the 31st of May and viewed on the 1st of June.

The MA times of the shortcut will change every time you open the file from floppy but the actual file residing on disk will only have the A time changed …(unless you modify also).

From testing on an XP (NTFS) system:

- Copying or moving a file from HDD to floppy will change the Access and Create times.
- Cutting or removing the file from HDD to floppy will only change the Access time (CM remain the same) as original.

Andrew-

 
Posted : 30/06/2005 1:29 am
(@djazz)
Posts: 8
Active Member
 

Hi,

if I understand your posting correct, "the actual file reallysecretstuff" is located on the hard drive and you don't have the floppy with reallysecretstuff.doc. You are not quite clear about the location you found this file.

If that is the case, you can say that a file with the name reallysecretstuff.doc was opened at least at 5/31/05 and 1/6/05. I would not speak about a copy of the file if you don't have the actual file. You can only state that the name is the same as…..

 
Posted : 02/07/2005 8:54 am
Share: