Regarding date and time stamps:
I have an enCase report that lists a number of WordPerfect files. One of the files in question has the following time stamp information:
FILE 1:
File Created: 06/01/05 03:20:37PM
Last Accessed: 07/07/05 02:02:53PM
Last Written: 04/07/04 12:27:49PM
Another file has this information:
FILE 2:
File Created: 05/24/05 10:53:18PM
Last Accessed: 06/04/05
Last Written: 05/24/05 10:54:08PM
FILE 1 suggests an obvious question: how can the last written date be previous to the file created date by over a year? I could understand a second or two with network timing issues, but 14 months?
FILE 2 poses another, possibly related question: the file in question is a template for filling out a form that was created by the user being investigated. It involves very picky placement of text boxes on a page, and would take even an expert user at least 20 minutes to create (if they were extremely lucky and got everything into the right place on the first try). How does that square with the idea that the time stamps indicate less than 1 minute between creation and last writing?
I have two possible explanations that come to my mind, and I'd like to know from people who KNOW datestamps on Windows XP (guesses, while they may help in some way, are not sufficient - this is going into prosecution, and I probably can't say to the lawyer "well, my best guess is ...." )
for FILE 1: is it possible that the file was created on another computer, say a home computer, on 04/07/04, and then copied to the new computer (an office computer) via floppy or a modem connection, and the moment of copying becomes the file create date, 06/01/05, while the last modifed date is retained as the "last written" date.
for FILE 2: to my mind, this could be the file being typed and tested for as long as needed, then saved for the first time at 10:53:18, and then saved finally at 10:54:08. Does this make sense, and can anyone suggest another exlpanation?
I'm on the prosecution side, and I'm trying to anticipate the kinds of ways the defense will poke holes in the evidence.
If you are an EnCase expert and can provide a definitive explanation with some published references (not necessarily yours, i would just like to be able to cite them), I will add 100 points on top of the 400.
Start Free Trial
