General discussion

Locked

File Properties

By Nom@d ·
I have been asked to find out about some Adult material found on our Server and somebody's Workstation.
Is it possible to know when the pictures and videos were first put onto the system and last accessed or viewed?
Does it make a difference to the dating of the pictures / videosif they are transfered from an old server to a new one?
If the pictures have been opened during the investigation does this complicate things?

Thanks
John

This conversation is currently closed to new comments.

3 total posts (Page 1 of 1)  
| Thread display: Collapse - | Expand +

All Comments

Collapse -

by BFilmFan In reply to File Properties

First do you have a corporate policy against this material?

What OS is on the server?

What OS is on the workstation?

You can check the date modified on the file, which would give you some idea the last time it was opened.

And yes if someone opened the file to see what it was and then reported it, it would change the date last modified.

You could check the file permissions on the old server's backups to see when the file was created and who created it.

Collapse -

by pkar In reply to File Properties

Forensic investigations of this type should NEVER been done directly on the machine you want to examine.
There are tools to do hard disk images for forensic investigations. these are not just backup copies of the HDD, they do exact copy of every piece/bit of HDD, so even previously deleted data can be accessed.
Once the image is done you can then examine file's properties, etc.
If the above steps are not followed, prosecution or any other legal proceeding may fail.
I'd advise to get a computer forensics company to do the investigation if the issue is serious.
For more info I'd advise to read: http://www.acpo.police.uk/asp/policies/Data/gpg_computer_based_evidence_v3.pdf

Regards,

Collapse -

by PCPapa In reply to File Properties

If the pictures have been opened during the investigation it is too late to do a forensic study. If they were transferred that would also have left holes from an evidentiary viewpoint. The chain of evidence has already been broken. No evidence you can get will hold up in court.

Back to Community Forum
3 total posts (Page 1 of 1)  

Related Discussions

Related Forums