File Date Forensics


Files stored in modern operating systems generally have the following dates assocated with them:

Date Created:
The date & time that this file was created on this machine, this would include the date downloaded from the Internet.

Date Accessed:
This is the last date that the file was accessed for reading by the machine or user.

Modification time aka MTIME
A file's modification time represents when the contents of the file was most recently changed. However, because operating systems don't check to see if the file actually changed, it can merely represent the last time that the file was saved by the application that had the file open.

Electronic Evidence in PLAIN English.

Like us on Facebook

Follow us on LinkedIn


Copyright © 2003 - 2024 Evidence Solutions, Inc. All Rights Reserved.

Search