windows file metadata

Windows seems to keep a very poor record of file attributes such as date created, date modified and date accessed. These attributes are important especially for audit purposes. My profs are even using these dates (in UNIX fortunately) as submission dates. Furthermore, I believe that these dates are especially important in computer forensics, to prove that a file exists before a certain date.

Below is a list of quirks.

* Date accessed is susceptible to a time lag of up to a few hours.

* Different behaviour on different FS (NTFS/FAT)

* Date created is set to current date when copying file. (So its possible to modify a file before it has even been created)

* Date accessed might not be changed depending on file type even when a file is opened.



Tags: Security

Similar Articles

Windows Persistency With OpenVPN GUI - OpenVPN GUI will automatically run the following batch files if it exists. No changes to config file is needed, just drop the batch file in place. Possible privilege escalation if user runs ...
Crash Windows Event Logging Service - While trying to write an undetectable event log cleaner, I delved into the NTAPIs to try to prevent Event ID 1102 from being created. In the process, I stumbled upon a way to crash the Windows ...
windows file metadata - Windows seems to keep a very poor record of file attributes such as date created, date modified and date accessed. These attributes are important especially for audit purposes. My profs are even ...
Windows Trust Boundaries - Understanding Windows trust boundaries is important as a penetration tester as security vulnerabilities are usually found at these boundaries. As an application developer, understanding these ...