Hello, I had a Samsung SCHi100 which I could image the micro SD card, but could not get into the phone itself. I was able to recover videos and photos, however, I noticed a couple of the video's file created dates ( I used enCase FYI) were an hour earlier than the default samsung file name For example
File created date was 11/04/12 084407PM
File name was ……\DCIM\Camera\2012-11-02 21.40.38.3gp
The other photos taken in the same context had the same file created time, and the file name reflected it as such.
I then had a photo (again from the same context) in which the file created time was an hour LATER than the file name…..
For example
File created date was 11/04/12 101304PM
File name was…..\DCIM\Camera\2012-11-04 21.13.04.jpg
According to my victim, the timeline corresponds with the file times on the NAME, not the file created times…. and the differences were all one hour either earlier or later.
I do not believe my suspect altered the name….no reason to. I believe the file name is the one Samsung assigned to the file when it was created….
Anyone see this before and does anyone have an idea why the anomaly?
Also FYI, location is in AZ where they do not have daylight savings. I noted it was 3 days from the end of daylight savings and thought it may be part of it, also it is near the Navajo Indian reservation where there can be a couple time zones, but not ON the reservation….(Navajo reservation does use daylight savings based on New Mexico, even in AZ areas…my suspect is Navajo, but again this was when AZ and New Mexico should have been back on the same time zone…sorry to confuse the issue…)
Thanks for any input