I am working a case in which I have several files of interest in the Recent Folder that have the same last accessed times. Not all files in the folder have the same last accessed time, only ones I believe would have been of interest to the suspect. I also checked other files and there is no evidence of some type of scan causing the touch.
The files of interest in the Recent Folder have last accessed date and time of 10/6/09 544 PM; however, when I check each individual file (on suspect's desktop) the last accessed time does not reflect this date and time. Some of the files have last accessed times back a couple of months.
I know that Windows may delay updating last access times up to an hour. The files on the desktop are not in a folder, simply existing as each individual file on the desktop.
What would cause all of the link files of interest in the recent folder to have the same last accessed times but not the files themselves?
What would cause all of the link files of interest in the recent folder to have the same last accessed times but not the files themselves?
The most basic answer is, of course, that something opened the corresponding shortcut files (i.e. 'opened' them from the viewpoint of the file system, not necessarily opened them in some kind of editor). That 'open' updates the last access time stamp.
For instance, last access time of a file changes if you 'hover' the cursor over its icon or name. It also changes if you right-click and view the pop-up menu – sometimes, at least (my tests are not really exhaustive).
I'm not quite certain it does so if you shift-click several files – my impression is that you have to do something with the files for the time stamp to change in this case. And even then, there seems to be a certain inconsistency between th standard choices. But the shift-click several files, right-click and do something could fit the bill.
(added the cases where I'm not sure, all the last access time stamps change. But I'm not able to repeat it. So there may be something else going on behind the curtains as well.)
Are there any non-standard choices on the popup-menu on this particular system?
The time stamp you mentioned was rather imprecise – were timestamps accurate only to seconds, or all the way down to the least nanosecond? That is also important to consider.
Of course, for anything like this to make sense, hidden files may have to be shown. Are they? Was that setting changed recently?
Does the number of items with the same date happen to be 15? Or perhaps be the same number that is displayed in the Recent Documents view in that version of Windows?
You might consider testing to see whether simply opening the recent docs view from the start menu in XP updates the access time for the link files used to populate that view.
Take a look at my paper on Link Files it may help.
http//
H
NTFS scans several folders on boot including the "Recent" folder, based on a "last looked at criteria" of about 2 hours, this will update the last accessed times.