±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 0 Overall: 36575
New Yesterday: 4 Visitors: 168

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Videos

±Latest Jobs

Audio File Creation Date is wrong

Discussion of legislation relating to computer forensics.
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
Page 1, 2  Next 
  

artshocx
Newbie
 

Audio File Creation Date is wrong

Post Posted: Sep 24, 12 20:38

i subpoenaed and received an audio file of a recorded hearing, however the creation date has changed. these folks should know better. i know they keep all active original audio files and must maintain them for a specified time period etc. and the subpoena specifies original, uncompressed, unaltered file, etc. has anyone run into this? i'm sure that it was simply ignorance, but i'm not sure what to tell them to do to keep that information in tact? in my experience, simply dragging the file onto a CD-RW wouldn't necessarily change a creation date, but i am not an expert on whether that might not be true of some burners, etc. it seems likely that they converted the original to mp3 and that's why the date changed. does anyone know? is there some standard that audio forensics follow to ensure chain of custody, at least as much as humanly possible? thanks.  
 
  

jhup
Senior Member
 

Re: Audio File Creation Date is wrong

Post Posted: Sep 24, 12 21:59

is this a third party that is not direct party, other than providing the audio, to the case?  
 
  

artshocx
Newbie
 

Re: Audio File Creation Date is wrong

Post Posted: Sep 24, 12 22:49

- jhup
is this a third party that is not direct party, other than providing the audio, to the case?


hello and thanks for your response. The party that provided the file, is the agency responsible for holding the hearing and recording the original file. as i said, i think they probably just didn't know. i'm just figuring out how to best explain to them a procedure that will protect the create date. it is my understanding that simply copying a file from one place to the next shouldn't do this, but they burned the file to a disk and i think that might be the issue. i believe if they knew how they probably would attempt to comply maybe, but i don't know what to tell them. thanks.  
 
  

artshocx
Newbie
 

Re: Audio File Creation Date is wrong

Post Posted: Sep 26, 12 21:04

Does anyone know how to do this on a PC? i work on a mac, so i do not have a PC to test this one. would it work if they zipped the file and then burned it? thanks.  
 
  

mscotgrove
Senior Member
 

Re: Audio File Creation Date is wrong

Post Posted: Sep 26, 12 21:54

Often by looking at the CD (start at sector 0x10) it is possible to have a good guess at the application that wrote the CD. You can then try and emulate the process and see what happens
_________________
Michael Cotgrove
www.cnwrecovery.com
www.goprorecovery.co.uk 
 
  

artshocx
Newbie
 

Re: Audio File Creation Date is wrong

Post Posted: Sep 26, 12 22:19

thanks, but at this point i'm just trying to explain to a client who is using a PC how to get me the file in a way that doesn't change that date and protects the integrity of the evidence. do you think zipping the file inside a folder might do it? thanks.  
 
  

mscotgrove
Senior Member
 

Re: Audio File Creation Date is wrong

Post Posted: Sep 26, 12 22:29

Zip might well help

Can your 'customer' give you the hash value of the file - this will prove that no content has or has not been changed.

What does the customer think the date and time is. Some programs (eg Wordpad I think) can change date and time just by opening the file for viewing. It is possible the date and time were 'corrupted' before the CD was burnt
_________________
Michael Cotgrove
www.cnwrecovery.com
www.goprorecovery.co.uk 
 

Page 1 of 2
Page 1, 2  Next