File information retrieval - modification dates

  bsugag 18:56 17 Jun 2009
Locked

Hello there,

I was wondering, is it possible to use any sort of specialist software or have any sort of specialist hardware analysis, to allow one to identify the last modification and creation dates and times of files on a hard disk?

I know this information can be seen simply at the properties of the file, but I've been told you can change this by changing the system clock and changing the files.

Is there any way to conclusively prove that files were created and last modified on a certain date, through any sort of examination of the hard disk or using any specialist software?

This is regarding a very urgent problem I have, and would greatly appreciate any help you can give me!

  bremner 19:41 17 Jun 2009

No

Any file date, be it a Windows properties date and time or a metadata imbedded date and time is dependent on the computer clock of the computer on which it resides.

Any user can change the computer clock so invalidating the accuracy of recorded dates and times.

  bsugag 19:46 17 Jun 2009

Is it then possible to prove that the computer clock has not been changed, or if it has been changed to track what those changes were?

  Technotiger 21:32 17 Jun 2009

I think you may be asking the Impossible - though Event Viewer, in Control Panel>Administrative Tools, does give a limited view of events on any PC.

This thread is now locked and can not be replied to.

Elsewhere on IDG sites

Xiaomi Mi Mix 2 review

See mcbess's iconic style animated for Mercedes-Benz

iPhone X news: Release date, price, new features & specs

Black Friday 2017 : date, sites participants & bonnes affaires