Moving Files

  • Thread starter Thread starter Guest
  • Start date Start date
G

Guest

I have a family member that has been accused of moving or trying to delete
files at work. My question is when the files are moved or deleted, is there
a date stamp generated and can that date stamp be changed or revised?
 
Bengie said:
I have a family member that has been accused of moving or trying to
delete files at work. My question is when the files are moved or
deleted, is there a date stamp generated and can that date stamp be
changed or revised?
Click to expand...




Yes, date stamps can easily be changed. They can't be used to prove
anything.
 
If "auditing" files in question was turned on then they would have a
username to work with.
 
Ken Blake:
Thank you for your response. Is there somewhere I can access a Microsoft
Document stating this fact about changing date stamps. I need some something
in writting from a legitimate source to appeal an accusation.
 
Bengie said:
Ken Blake:
Thank you for your response. Is there somewhere I can access a
Microsoft Document stating this fact about changing date stamps. I
need some something in writting from a legitimate source to appeal an
accusation.
Click to expand...


I don't know a Microsoft document, but if you google change date stamp,
you'll find lots of hits for programs that can do this.

--
Ken Blake - Microsoft MVP Windows: Shell/User
Please reply to the newsgroup

 
Bengie said:
Ken Blake:
Thank you for your response. Is there somewhere I can access a Microsoft
Document stating this fact about changing date stamps. I need some
something
in writting from a legitimate source to appeal an accusation.
Click to expand...

Here's some software to change dates, times, etc.

http://www.nirsoft.net/utils/filedatech.html

http://www.freewarehome.com/index.h...File_Management/Change_File_Attributes_t.html

http://www.febooti.com/products/filetweak/

etc. Google file+date+change
 
Bengie said:
I have a family member that has been accused of moving or trying to
delete files at work. My question is when the files are moved or
deleted, is there a date stamp generated and can that date stamp be
changed or revised?
Click to expand...

When you copy a file that date stamp is updated.
There unfortuntely are many programs available that can "touch" or change
the date attributes on a file.
Sometimes you can get hints about what happened to a file by going to
Properties for it and looking at the history Revisions tab etc.. Also Last
Accessed if they haven't turned it off.

If there's a decent IT department, then one possibility is that they have
his permissions set so that he cannot install/create such programs? If not,
then they should, depending on his functions.

Is he a newbie or an experienced user? Newbies can often "move" files
unwittingly if they'll just look into the procedures he uses to do things.

If the IT dept is any good, they also turns on some audits that would show
in logs what he did, before making any accusations. If that's the case,
he's pretty much lost the battle.

Just some thoughts,
Pop
 
Back
Top