File information retrieval - modification dates

  bsugag 18:56 17 Jun 09
Locked

Hello there,

I was wondering, is it possible to use any sort of specialist software or have any sort of specialist hardware analysis, to allow one to identify the last modification and creation dates and times of files on a hard disk?

I know this information can be seen simply at the properties of the file, but I've been told you can change this by changing the system clock and changing the files.

Is there any way to conclusively prove that files were created and last modified on a certain date, through any sort of examination of the hard disk or using any specialist software?

This is regarding a very urgent problem I have, and would greatly appreciate any help you can give me!

  bremner 19:41 17 Jun 09

No

Any file date, be it a Windows properties date and time or a metadata imbedded date and time is dependent on the computer clock of the computer on which it resides.

Any user can change the computer clock so invalidating the accuracy of recorded dates and times.

  bsugag 19:46 17 Jun 09

Is it then possible to prove that the computer clock has not been changed, or if it has been changed to track what those changes were?

  Technotiger 21:32 17 Jun 09

I think you may be asking the Impossible - though Event Viewer, in Control Panel>Administrative Tools, does give a limited view of events on any PC.

This thread is now locked and can not be replied to.

Nintendo Switch review: Hands-on with the intuitive modular console and its disappointing games…

1995-2015: How technology has changed the world in 20 years

Prehistoric Britain is laid out in these Royal Mail stamp illustrations

Best running headphones | Best sport & fitness headphones: 4 brilliant pairs of wireless…