I have a case where the files in question have been recovered from a backup. My question is, is there any way a recovered files documents can change from backup to recovery i.e. Timestamps?
I do not at this moment know the software used, but I am guessing is it not bespoke. Also from my research I have used NTBACKUP and to my surprise the timestamps do not change when recovered(I know the timestamp of the MFT on the computer would, however the original computer is gone, hence the backup).
Does anyone know if there is a possibility of the timestamps would change? From the backup, to when it is recovered? And any other way to verify the timestamps?
Much appreciated,
Craig
First thing is to identify the backup type and product used.
In the case of NTBackup, the following artifacts/timestamps apply
FOR FILES
1. File Created and Last Written remains the same
2. Last Accessed and Entry Modified are changed to the time they were restored
3. The Archive bit is set on the restored files
4. The Hash values are the sameFOR FOLDERS
1. File Created remains the same
2. Last Accessed, Entry Modified and Last Written are changed to the time they were restored
3. The Hash values are differentPlease note, 'changed to the time they were restored' is not one specific time, the process of restoration may take some time and so these values are at the time a specific action was made, not the overall restoration time of the entire backup.
Thanks for the reply pbobby. Those are exactly what I am looking for.
I can't seem to replicate the results however can you send me the reference/book where the information came from? I would like a reference for court.
Thanks again!
This came from my own testing - in restoring from a backup and comparing timestamps pre and post.
Weird, I ran the backup and recovery on some files and the timestamps where identical (using NTBACKUP).
You got that the 'Last Accessed and Entry Modified are changed to the time they were restored'.
Would it be the OS or the actual backup application used that changes/keeps the timestamps?