Re: Creation / modification / access dates

From: Andrew Sheldon <forensics(at)4warn.net>
Date: Mon Jul 14 2003 - 15:13:26 EDT

Hmmm.

>> >.... Obviously, this is keyed to the BIOS of the computer used to write
>the CD.

What I *intended* (and assumed everyone in the forensics list would already understand as a fundamental principle) was that ALL dates or times applied to ANY file activity would be dependant upon the current system clock (the real time clock) of the system controlling the activity. Therefore, all dates and times should be treated as suspicious.

Agreed, I should have been more specific (RTC rather than BIOS) but, given the above, I believe the original question was... "Firstly, is there any way to determine the creation date of a CD-ROM - is that information stored somewhere as part of the CDFS?" ...and I believe I indicated two sources of "possible" dates and times.

Trust them or throw them out - the dates are open to question but they ARE there to be seen. :-)

Andy

• REPLY SEPARATOR ***********

On 14/07/2003 at 14:39 Valdis.Kletnieks@vt.edu wrote:

>On Mon, 14 Jul 2003 19:17:22 BST, Andrew Sheldon said:

---

This list is provided by the SecurityFocus ARIS analyzer service. For more information on this free incident handling, management and tracking system please see: http://aris.securityfocus.com Received on Mon Jul 14 16:25:58 2003