A: your opinions plz
I was curious what conclusion everyone would arrive at if they say this in an investigation.
In the recent folder
A:\reallysecretstuff.doc .lnk file
the actual file reallysecretstuff (please forgive the really cheesy name) woulld have times like
Would you think the file was recently copied from the hard drive to a floppy?
A copy from a floppy was recently viewed?
Thank you for your opinions, hope everyone has a good day.
As anyone with more experience will attest to time stamps can be a dicey subject but from what youâ€™ve provided I would think that the file was copied to floppy on the 31st of May and viewed on the 1st of June.
The MA times of the shortcut will change every time you open the file from floppy but the actual file residing on disk will only have the A time changed …(unless you modify also).
From testing on an XP (NTFS) system:
- Copying or moving a file from HDD to floppy will change the Access and Create times.
- Cutting or removing the file from HDD to floppy will only change the Access time (CM remain the same) as original.
if I understand your posting correct, "the actual file reallysecretstuff" is located on the hard drive and you don't have the floppy with reallysecretstuff.doc. You are not quite clear about the location you found this file.
If that is the case, you can say that a file with the name reallysecretstuff.doc was opened at least at 5/31/05 and 1/6/05. I would not speak about a copy of the file if you don't have the actual file. You can only state that the name is the same as…..