Hello i'm using EnCase and i noticed some strange timestamps for a .doc
Last Accessed 03/09/06 091606πμ
File Created 03/09/06 091606πμ
Last Written 02/25/05 014533μμ
Entry Modified 08/24/05 031804μμ
File Acquired 01/19/07 122856μμ
How is it possible to Create a document at 3/9/06 and the last written and entry modified entries show 2005 ?
Any explanations ?
Yes.
You didn't specify the OS (we can assume Windows) or file system (FAT or NTFS), so I'd suggest taking a look at this KB article
http//
You don't know how much you helped me. Thank you very much, forgive my stupidity. )
Stupidity would have been you making an assumption of your evidence without knowledge.
Asking for help, then using that help to arrive at the truth is anything but stupidity.
)
I don't know for sure, I would try to recreate the results, or similar results, on a test machine using the same OS. It takes some time but it provides the best results.
-Dawson