- #1
unglax
- 1
- 0
I am involved in a legal case and I need to know some things about flash drives.
1. Does anyone know if it is possible to find out for sure exactly when a file was saved onto a flash drive? I know that you can acess the "Date Created" and "Date Modified" information through by right clicking and then clicking "Properties", however, these dates can be easily faked just by changing the computers clock time.
2. I would also like to know if there is some hidden function on flash drives that records the MAC address of the computers it was plugged into or records the order in which files were added, because then it would be possible to show that a certain file with a faked "Date Created" date, was actually added between two other files with non-faked "Date Created" dates which prove, or at least suggest, that it was added within a different time period.
3. Another possible route might be to show the order in which files were added by looking at the actual location of the data on the drives so it would also be helpful to know if flash drives fragment the data, or have it in continuous strips.
Btw: I am not going to use these responses for legal purposes or anything, I am just looking at possible avenues of further research, or expert testimony.
1. Does anyone know if it is possible to find out for sure exactly when a file was saved onto a flash drive? I know that you can acess the "Date Created" and "Date Modified" information through by right clicking and then clicking "Properties", however, these dates can be easily faked just by changing the computers clock time.
2. I would also like to know if there is some hidden function on flash drives that records the MAC address of the computers it was plugged into or records the order in which files were added, because then it would be possible to show that a certain file with a faked "Date Created" date, was actually added between two other files with non-faked "Date Created" dates which prove, or at least suggest, that it was added within a different time period.
3. Another possible route might be to show the order in which files were added by looking at the actual location of the data on the drives so it would also be helpful to know if flash drives fragment the data, or have it in continuous strips.
Btw: I am not going to use these responses for legal purposes or anything, I am just looking at possible avenues of further research, or expert testimony.