Unotherised Word doc access

  lizziejamescaroon 20:31 29 Jul 14

Hello...bit of a tricky one,

My SD card went missing out of my wallet, turning up two hours later. The person who claimed to have found it, has,I fear, accessed it and copied documents from it. To check, I put the card in my laptop, and a number of the Word files and one Jpeg were shown to be accessed at 00.00 on 29 July 2014 in the Properties tab.The SD card was sitting on my desk at that time, so that was impossible. However, I reset the time and date on my laptop, and it was possible to access a file with a falsified date and time stamp on the laptop, with little trouble. About 20 files were showing the aforementioned odd time and date stamp, so I am very suspicious. If what I suspect, has happened, can the identity of the computer that accessed the files be traced via the forensic file data or the SD card? Does the SD and or files in question even hold that sort of forensic data? Can meta data be just wrong???

Any help /suggestions hugely appreciated!

Thanks, Lizzie

  Fruit Bat /\0/\ 17:35 30 Jul 14

Anyone with admin privileges can change a files metadata

If the files and folders on the drive are not encrypted then anyone can access them.

No you cannot find out which PC the files were accessed on or card plugged into (regardless of what you see on CSI) from the card.

However if they were accessed on a companies networked PC your IT department may be able to see what files were accessed on a particular PC at a particular time depending on what sort of logging you IT department carries out.

This thread is now locked and can not be replied to.

Surface Pro (2017) vs Surface Pro 4

20 groundbreaking 3D animation techniques

How to mine Bitcoin on Mac