hcso1510,
I have no idea if Facebook keeps EXIF data. I would kind of doubt it with the billions of pictures that have been uploaded.
The dates and times that the pictures were created in the My Pictures folder are known (step 20 and 24 of the timeline above). The date that the pictures were posted on the user’s Facebook page, IF they were, is shown when viewing the picture. Since I don’t have access to the student’s Facebook page, I can’t see what date that might be. Facebook might keep logs of what’s uploaded and at what time but I’m pretty sure that they only keep such logs for a certain time only.
Given that one of the pictures still has its EXIF data and is bigger in size than what Facebook resizes them to, the picture did not come from Facebook.
No, I’m not in law enforcement and this case would not have warranted any LE involvement. Since LE wouldn’t be involved, a polygraph wouldn’t be done. Even less so since that is not part of a school’s regular equipment…
Again, I don’t have any information on any educational, or private, doings between either party. Nor do I have the schedule or class attendance but students were in the classroom at the time of the discovery and the teacher was not. I just have what the student told the principal and what I was told by the school’s IT director.
Students, especially in high school grades, often use a teacher’s computer for research purposes. Of course, a teacher should be present at all times during class hours and when not present, the computer should be locked.
The 101021 and 101055 times correspond to 2 different events (steps 20 and 24 of the timeline above) which are the creation of the 2 pictures (student1.jpg and student2.jpg) in the My Documents folder.
I’m not at liberty to give the outcome of this incident.
Dave
Rob Lee was doing some research into the differences of the date/time stamps in the Standard Information and Filename attributes in the MFT based on what type of action was taken. You can read his blog post at http//