Chapter 30. Computer Time Artifacts (MAC Times)
Information in this chapter:
• Computer file system time stamps
• Fundamental Issues in forensic analysis of timeline
• Created, modified, accessed
• The bottom line
Computer time stamps play a role in many cases, both civil and criminal. Computer time artifacts are undoubtedly one of the most important forms of digital evidence. They play a critical role when establishing a timeline for a body of evidence for any case where time is important. If the case involves an alibi, computer time artifacts can be used as part of a body of evidence to negate or validate the alibi claims. If the case involves data theft, computer time artifacts can be used to help determine when the alleged theft occurred.
The purpose ...
Get Digital Forensics for Legal Professionals now with the O’Reilly learning platform.
O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.
