OS Forensics Question

[davidk]

I'm new to all this, and just trying it all out. How do I view the deleted date on any document, is that the same as the last modified date?

[David (PassMark)]

It might not be possible.

In what state was the deleted document.

Was the document 'deleted' to the recycle bin (i.e. not really deleted but just moved)?
OR
Was the document deleted, but then found in the file allocation tables and restored?
OR
Was the document lost and this carved back into existence directly from the disk.
OR
Something else. e.g. the file was wrapped up in a compressed Zip file?

[davidk]

Thanks for the reply. The files/documents we believe were deleted or removed as far as possible to avoid being found (if you know what i mean). We do think a large number were removed around the same time.
Also am I right in thinking if the clock timeis changed if can just look like they were deleted at a different moment in time...
Thanks for any info you may have on the subject.

[David (PassMark)]

I am really asking about where / how you found the deleted files. You shouldn't have to guess about this, if you found a file.

we believe were deleted or removed as far as possible to avoid being found (if you know what i mean).

No, not really. In that case they would have zeroed the hard drive & nothing would be recovered. So clearly they didn't do this if you have found some files somewhere.

if the clock timeis changed if can just look like they were deleted at a different moment in time...

All file system time stamps work from the system clock. If the clock is wrong, then time stamps will be also be wrong. However Windows auto syncs the time with internet time. So unless some special effort is made the system time tends to quickly correct itself.

[Forensik]

Be aware that some OS and File Systems do not update Modify Time unless configured correctly.