Thrustworthyness of...
 
Notifications
Clear all

Thrustworthyness of MAC times ...

11 Posts
5 Users
0 Reactions
1,391 Views
(@gmarshall139)
Reputable Member
Joined: 21 years ago
Posts: 378
 

I think it builds your case in that direction. I don't think it's definitive.

Can I switch the clock, then create/modify a few files without creating a log entry?

If I did create an out of sequence log entry could I delete the entry from the log?

Could I attach the hard drive to another computer and alter/add the files I wanted without booting it's OS?

Can I use something such as Attribute Magic to alter those times?

Could I manually alter the MFT entries for the files in question?

I don't think you'll answer these questions definitively from the computer alone. The people who possessed the computer are part of the chain of custody now. They can testify to what they did with it.


   
ReplyQuote
Page 2 / 2
Share: