File Created Vs Last Written Vs Last Accessed Dates?

Following this example
"File Created 11/04/2013 21:01:19
File Written 12/04/2013 17:23:52
Last Accessed 12/8/2013 10:01:19"
If this info where from a video. And it has the same date and time in "File created" and "Last Accessed", this means the video was never opened or watched?
Also, if the last written date has a date after when it was created or accessed, in this case with the same date and time as the example, it means the video was opened or watched? For example if you opened the video with WMP (Windows MEdia Player) this can change the "Last written date"???
Which exactly, (examples) can change the last written date of a video (mp4) on a windows system? a system defragment? a antivirus scan?
floresnAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

KimputerCommented:
same date and time in "File created" and "Last Accessed", this means the video was never opened or watched?

Correct, not watched

Also, if the last written date has a date after when it was created or accessed, in this case with the same date and time as the example, it means the video was opened or watched?

Video was saved at a later date than created. You cannot find the watched date if it was before the last save. You can only guess it was watched if the Last Accessed date is after the Last Modified date.

For example if you opened the video with WMP (Windows MEdia Player) this can change the "Last written date"???

WMP is a player, not an editor. It will only READ the file, Last Modified date will NOT change, only Last Accessed.

Which exactly, (examples) can change the last written date of a video (mp4) on a windows system? a system defragment? a antivirus scan?

Only an full overwrite (copied over original), or a save through a video editor (for example, Adobe After Effects) will change the Last Modified date. Most antivirus packages DO NOT change Last Accessed. Defrag will also NOT change Last Accessed.
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
btanExec ConsultantCommented:
0
Jonathan FloodCommented:
Be careful with the assumption that players do not edit. They store a lot of information inside the file for easier access later such as ID3 tags in MP3s. Most normal windows actions (defrag, AV etc) do not change the time stamps on a file. However...file time stamps are very fickle in general and if the file gets moved around, opened up in something that might download data from the web and save it in the file, etc etc. the times can be modified. I see modified times before created times ALL the time because a simple copy paste from one file system to another can result in information being lost.

Kimputer's comments are generally correct but I have seen very odd scenarios in my experience (Forensic Investigator & eDiscovery Professional for 10 years)
0
btanExec ConsultantCommented:
As er advice given
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Digital Forensics

From novice to tech pro — start learning today.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.