Notifications
Clear all
General (Technical, Procedural, Software, Hardware etc.)
2
Posts
2
Users
0
Reactions
306
Views
Topic starter
19/05/2011 12:13 am
Where on the computer does an investigator look for how documents were uploaded or transferred from a hot swappable device or disc for example?
And, where do you find the dates and times of when documents were saved on the hard drive?
The properties of each and every file displays a time and date, but can this be contradicted by another source of data?
19/05/2011 4:31 am
The create time is the time a file was created on the hard drive. This would be the time it could have been copied onto the drive.
Thus the create time can be later than the modified time.
I have never found the access time much use as too many things can change it, eg anti-virus