windows file metadata

Windows seems to keep a very poor record of file attributes such as date created, date modified and date accessed. These attributes are important especially for audit purposes. My profs are even using these dates (in UNIX fortunately) as submission dates. Furthermore, I believe that these dates are especially important in computer forensics, to prove that a file exists before a certain date.

Below is a list of quirks.

* Date accessed is susceptible to a time lag of up to a few hours.

* Different behaviour on different FS (NTFS/FAT)

* Date created is set to current date when copying file. (So its possible to modify a file before it has even been created)

* Date accessed might not be changed depending on file type even when a file is opened.