Avatar of baleman2
 asked on

How do I find the date and time a File/Folder/Software was copied or installed on a Windows 2008 server?

Unless I'm missing something very obvious, I'm dabbling a bit in computer forensics on one of our company servers.  I'm trying to determine the date that Folders/Files were copied from a DVD to a shared folder on the server's hard drive.

A Right-Click on the Folder with a look at "Properties" provides me with Date Created.  However, the date shown here just doesn't jibe with the memory of those end users who initially used Copy/Paste to place the folder on the hard drive from the DVD.

Is there any way that the Server would have recorded this information?
Windows Server 2008Miscellaneous

Avatar of undefined
Last Comment
Enabbar Ocap

8/22/2022 - Mon
Brent Arnold

Is the date/time of the created folder before or after the customer's recollection? I've never seen a folder take a date/time PRIOR to it's true created date. Sometimes editing a folder will reflect a later date, but that's not necessarily the same as date created.

We have documentation requesting that this Folder (full of Adobe PDF templates) be installed on a particular date in July 2012.  Properties of the Folder show "Date Created" to be February 2013.  We don't believe the person responsible for the Copy/Paste procedure would have waited that many months to complete such a simple task.  Because of the information contained within the folder, it's important that we find the date, if possible, of installation.
Enabbar Ocap

If the folder was moved it takes the created date of the move, modified date is also the date of the move. ie if you move a folder today(and move it back if you like), it takes today's date for created and modified.
Experts Exchange is like having an extremely knowledgeable team sitting and waiting for your call. Couldn't do my job half as well as I do without it!
James Murphy

To Angela:

So, let me get a bit more specific.  Pick the date of October 1, 2013.  I drop a DVD into the drive that contains a folder named "TEST".  It has 20 subfolders, which, in turn, have 20 different .pdf files in each subfolder.  Let's call one of these subfolders "SUB1".

When I copy the "TEST" folder from the DVD to a shared drive on the server, the "Date Created" for the "TEST" folder is October 1, 2013.  Does this date remain static forever?  That is, if I open the subfolder named "SUB1" and modify/save some of the .pdf files contained in that subfolder, what, if anything happens to the "Date Created" and "Date Modified" properties of the main folder named "TEST"?

Our issue is that we need to know with some certainty that the "TEST" folder was absolutely moved to the server on October 1, 2013.
Enabbar Ocap

I will try the affect of touching files in the subfolder tomorrow and report back.
What I can definitely tell you is that if the test folder itself was moved, perhaps by accidentally dragging it under anothet folder, and then moved back, it will take on the created date of the move- not when it was first created on the machine.
I had a quick look for other date attributes but there only seem to be created, modified and accessed, no help to you.
Can you perhaps locate othet files that may havr used the templates and get some sort of cross check from them?
Brent Arnold

I know this is a silly question but do you have no form of incremental backup to look up the history of this file?
Get an unlimited membership to EE for less than $4 a week.
Unlimited question asking, solutions, articles and more.

We backup nightly to a DPM server, but keep only 4 consecutive days of backups.  We're attempting to establish the date that this folder was first copied to the Server's hard drive.  We know this occurred sometime in 2013.  The DPM server wouldn't help me here, would it?
Brent Arnold

I know that you only keep 4 consecutive days of backups, but it doesn't necessarily mean you only have 4 days of backup reports. My backups send a report of each transaction. I didn't know if you could look at the backup reports for your answer.
Enabbar Ocap

Apologies, I cannot recreate the date change I'm sure I had yesterday.
Today I created c:\test waited one minute and created test\sub, one more minute and created a file under sub.
Test create date has not changed. Test modified date is altered when a subfolder is added or moved. The creation date remains, even moving the folder keeps the create date to when it was created on the machine.
There are utility programs which allow you to alter all dates and times, but I can't imagine why someone would have altered that folder.
I can think of a few possibilities for you:
User had a replacement machine or new disk or a rebuild - check company records/other folder dates on the machine.
User intended to do the copy but the dvd was unobtainable until later - check other emails around that date perhaps trying to locate the disk, or chasing the job to see if it was copied yet.
Copy was done but to the wrong location and not discovered until 2012 when it was corrected.
A software update caused the date change - may be able to check update release dates of the product.
I would check all the date ranges on the machine to see if there could have been a significant rebuild and check all communication around your two dates looking for any mention of activity involving the program, the templates, or the dvd/copying job.
(still trying to alter the create date in some way).
I started with Experts Exchange in 2004 and it's been a mainstay of my professional computing life since. It helped me launch a career as a programmer / Oracle data analyst
William Peck
Enabbar Ocap

Log in or sign up to see answer
Become an EE member today7-DAY FREE TRIAL
Members can start a 7-Day Free trial then enjoy unlimited access to the platform
Sign up - Free for 7 days
Learn why we charge membership fees
We get it - no one likes a content blocker. Take one extra minute and find out why we block content.
Not exactly the question you had in mind?
Sign up for an EE membership and get your own personalized solution. With an EE membership, you can ask unlimited troubleshooting, research, or opinion questions.
ask a question
Enabbar Ocap

Sorry for double post, I'm blaming the new site look and feel!
Enabbar Ocap

Unlikely but possible.
Right click folder Send to>compressed/zipped folder.
Delete the original and unzip the compressed one. The create date is when it was unzipped, files within it keep their original date.