Tucker,
you are very kind. This is really fascinating. I'm new at foresncis, but I know I'm goint to learn a lot in this case. At this very moment, I'm creating a virtual machine of the raw image of the computer I'm investigating. I'll try some tools to examine the registry, hives and artifacts.
Thanks a lot for your help!
as far as i know in windows OSes, and on NTFS filesystems when you COPY a file, a new timestamp is defined for the creation date of the target file, while the last modified date is inherited by the source file.
So it's not uncommon on windows formatted hard drive (especially those used for storage purposes) to see file where the creation date is later then the last modify date.
from this you can also infer that the file you are analyzing is most likely a copy of a file which was existing elsewhere and which wasn't edited after the copy process
correct me if i'm wrong.
Rampage,
what you say seems to be the most likely scenario.