Free Republic
Browse · Search
Bloggers & Personal
Topics · Post Article

Skip to comments.

Can archived computer files be faked with respect to date and content?
04/29/15 | Grumpygresh

Posted on 04/29/2015 8:15:40 PM PDT by grumpygresh

Question for all freeper computer experts. I have a case where I have reason to believe that my opponent has faked the date and content of a website as it appeared in January through April 2011. I have used the way back machine and found that my opponent did not the information that they claimed to have had on the website between January to April 2011. I have not yet received any paperwork or computer file from my opponent. But when I do get the computer file, could it be faked with respect to the date and content? What would be the best course of action to reveal the fraud?


TOPICS: Computers/Internet; Government; Science
KEYWORDS: computerarchiving
Navigation: use the links below to view more comments.
first previous 1-2021-4041-53 last
To: grumpygresh

My company does computer forensics. Yes it can be faked BUT it takes an expert. A website isn’t good proof as its so easy to change. If you have proof that it wasn’t there it’s probably better than anything he has.

Hiring experts to prove or disprove is expensive.


41 posted on 04/30/2015 2:01:53 AM PDT by driftdiver (I could eat it raw, but why do that when I have a fire.)
[ Post Reply | Private Reply | To 1 | View Replies]

To: grumpygresh

Look for inconsistencies. It’s all files. All stamps the same date time? Examine contents for date,references that don’t jibe. What kind of files? .jsp and htm files have all kinds of meta data. Even word processing documents and pdfs have internal meta data.


42 posted on 04/30/2015 3:33:14 AM PDT by ImJustAnotherOkie
[ Post Reply | Private Reply | To 4 | View Replies]

To: grumpygresh

Hillary’s server???

Use a forensic expert. To do otherwise can destroy evidence.

I’ve been involved as a litigation consultant in several fraud cases involving computer files. It is very important to create a working copy and not to open the original file provided. Opening the file can change the hash totals.


43 posted on 04/30/2015 3:33:21 AM PDT by tired&retired
[ Post Reply | Private Reply | To 29 | View Replies]

To: grumpygresh

I don’t know about online data, but with general applications, i.e., Word, Excel, etc., you used to be able to set the computer’s calendar and/or clock to an earlier time, create/modify the document, save it, and that’s what would show up in Summary or Properties. That was years ago; not sure if it’s still possible.


44 posted on 04/30/2015 3:37:52 AM PDT by MayflowerMadam
[ Post Reply | Private Reply | To 1 | View Replies]

To: grumpygresh

The programs that initially create and tag the files with the created/modified data use the system clock. It would be easy enough to reset the system clock to a previous/later date and copy the data from the original document to a document created with a modified system clock. Possibly tedious. I haven’t had reason to search out if there are any apps that would allow one to modify that data w/o going through a process like that though. If you just copy a document on the hard drive, it show the original data. I haven’t played to see if copying it to an external drive might provide new data and also remove/modify the version history.


45 posted on 04/30/2015 4:39:41 AM PDT by trebb (Where in the the hell has my country gone?)
[ Post Reply | Private Reply | To 1 | View Replies]

To: grumpygresh

it can be changed to show any modification timestamp even with a simple “touch” command. That being said, there are ways to reveal the modifications (that would also show some intent depending on which side of this you argue). Forensics evaluation could reveal the modifications. Another (and even simpler way) is if you can get copies of backup media and especially detailed logs from the backup software. The logs will show the previous timestamps of the files that would show something different than what they provide. The backup media will also show a timestamp of the file before it was changed. The timestamp of the file on backup media cannot be very easily modified (depending on the backup method and software used).


46 posted on 04/30/2015 4:48:00 AM PDT by FunkyZero (... I've got a Grand Piano to prop up my mortal remains)
[ Post Reply | Private Reply | To 1 | View Replies]

To: grumpygresh

Timestamps on a computer can be modified using the command line “touch” command.


47 posted on 04/30/2015 5:01:19 AM PDT by Flick Lives ("I can't believe it's not Fascism!")
[ Post Reply | Private Reply | To 1 | View Replies]

To: E. Pluribus Unum

Such a vague question... It needs to be narrowed down to type of computer, software, etc.

I have a website running content management software. It runs on the Apache operating system the most free servers use.

There is a daily log file on that the apache system uses. It logs all changes to the system made by the users.


48 posted on 04/30/2015 5:23:13 AM PDT by Pikachu_Dad (Impeach Sen Quinn)
[ Post Reply | Private Reply | To 2 | View Replies]

To: grumpygresh

With a hex editor, you can compare file contents.

http://www.flexhex.com/docs/howtos/file-comparison.phtml


49 posted on 04/30/2015 3:52:38 PM PDT by smokingfrog ( sleep with one eye open (<o> ---)
[ Post Reply | Private Reply | To 27 | View Replies]

To: grumpygresh

Not sure how that matters unless you have access to those archives. Regardless, I could simply say “I have no idea how they all have copies of a file other than this one. This is the file I manage.”


50 posted on 04/30/2015 4:28:52 PM PDT by TheZMan (I am a secessionist.)
[ Post Reply | Private Reply | To 33 | View Replies]

To: smokingfrog

So, could this work for two versions of a website page that should correspond to one date? Could I compare a WB machine website page from Jan 2011 with a likely altered page purportedly from Jan 2011 that was used to show something else?


51 posted on 04/30/2015 4:52:33 PM PDT by grumpygresh (Democrats & GOPe delenda est. President zero gave us patient zero.)
[ Post Reply | Private Reply | To 49 | View Replies]

To: grumpygresh

Answer is yes. BUT if it got on the net very hard to wipe it all. If it was on a local network then a competent IT guy could do it. Like others said several locations for dates, time etc. If there are images involved you need an expert to trace them.


52 posted on 04/30/2015 4:57:49 PM PDT by mad_as_he$$
[ Post Reply | Private Reply | To 1 | View Replies]

To: grumpygresh

I’m no expert, but it looks to me like it could.

As someone else said (I think), you would only want to examine copies of those files, since accessing or opening the original document could change the content. Sounds like a forensics expert is needed, but what you are looking to accomplish certainly seems doable.

I don’t know how those way back files are generated, but it seems like there should be a way to determine exactly when they were archived.


53 posted on 04/30/2015 5:22:22 PM PDT by smokingfrog ( sleep with one eye open (<o> ---)
[ Post Reply | Private Reply | To 51 | View Replies]


Navigation: use the links below to view more comments.
first previous 1-2021-4041-53 last

Disclaimer: Opinions posted on Free Republic are those of the individual posters and do not necessarily represent the opinion of Free Republic or its management. All materials posted herein are protected by copyright law and the exemption for fair use of copyrighted works.

Free Republic
Browse · Search
Bloggers & Personal
Topics · Post Article

FreeRepublic, LLC, PO BOX 9771, FRESNO, CA 93794
FreeRepublic.com is powered by software copyright 2000-2008 John Robinson