Overclock.net › Forums › Software, Programming and Coding › Operating Systems › Windows › Been asked to testify in a court case, could use some advice
New Posts  All Forums:Forum Nav:

Been asked to testify in a court case, could use some advice

post #1 of 13
Thread Starter 
I've been asked to testify in a court case. One of the items that will come up is the creation date of a document (under windows).

Essentially, our side is disputing the creation date of a document. They say for example that it was created May 1st 2012. We assert that it was created several months later but the computer was rolled back to make it look like it was created on May 1st.

I know that it is easy to roll back the date on the computer, create a document, save it and then change the date back which will in effect show the desired date on the properties of the file.

Is there a way or a tool (or even a forensic service) that could examine the hard drive of the computer and determine the actual date it was created as opposed to the date listed in the properties?

We know for a fact that it was created later but have to provide proof that there is a way that the hard drive of the computer can verify the actual creation date as opposed to the modified creation date.

I read somewhere that there are internal date markers encoded INSIDE MS Word documents but not sure how to find them.


Thanks
Edited by Robilar - 4/15/13 at 6:02am
Murder Box II
(18 items)
 
Home PC
(15 items)
 
 
CPUMotherboardGraphicsRAM
Intel 6800K Asus X99-A II Zotac 1080Ti AMP Extreme Edition G. Skill Trident Z - 32GB/ 3200Hz/CL14/Quad  
Hard DriveCoolingOSMonitor
Sandisk Extreme Pro 480GB Corsair H100i V2 - w/ML120 Pro Fans Windows 10 Home 64 Bit Acer Z35P 1440P G-Sync 
KeyboardPowerCaseMouse
Steelseries Merc  EVGA Supernova G2 1000W Corsair 450D Mionix Naos 8200 
Mouse PadAudioAudioOther
Inwin Batmat Aluminum Sound Blaster Z Logitech Z906 - 5.1 Maxnomic Commander S-III Gaming Chair 
CPUMotherboardGraphicsRAM
Intel G3440 Asus B85M-E/CSM EVGA GTX 950 Patriot Viper 3 - 2x8GB 1600hz 
Hard DriveOptical DriveCoolingOS
Samsung EVO 850 - 500GB + 4TB/3TB x 2/2TB WD Green LG CH12LS28 Bluray Scythe Big Shuriken 2 w/Corsair SP120 Fan Windows 10 64 Bit 
MonitorKeyboardPowerCase
Samsung 75" TV.... GooBang Doo MX3 Corsair CX430 V2 NMEDIAPC HTPC 6000B w/ Pro LCD Module 
Mouse
GooBang Doo MX3 
  hide details  
Reply
Murder Box II
(18 items)
 
Home PC
(15 items)
 
 
CPUMotherboardGraphicsRAM
Intel 6800K Asus X99-A II Zotac 1080Ti AMP Extreme Edition G. Skill Trident Z - 32GB/ 3200Hz/CL14/Quad  
Hard DriveCoolingOSMonitor
Sandisk Extreme Pro 480GB Corsair H100i V2 - w/ML120 Pro Fans Windows 10 Home 64 Bit Acer Z35P 1440P G-Sync 
KeyboardPowerCaseMouse
Steelseries Merc  EVGA Supernova G2 1000W Corsair 450D Mionix Naos 8200 
Mouse PadAudioAudioOther
Inwin Batmat Aluminum Sound Blaster Z Logitech Z906 - 5.1 Maxnomic Commander S-III Gaming Chair 
CPUMotherboardGraphicsRAM
Intel G3440 Asus B85M-E/CSM EVGA GTX 950 Patriot Viper 3 - 2x8GB 1600hz 
Hard DriveOptical DriveCoolingOS
Samsung EVO 850 - 500GB + 4TB/3TB x 2/2TB WD Green LG CH12LS28 Bluray Scythe Big Shuriken 2 w/Corsair SP120 Fan Windows 10 64 Bit 
MonitorKeyboardPowerCase
Samsung 75" TV.... GooBang Doo MX3 Corsair CX430 V2 NMEDIAPC HTPC 6000B w/ Pro LCD Module 
Mouse
GooBang Doo MX3 
  hide details  
Reply
post #2 of 13
im unsure but there could be restores saved in the same timeframe, say a restore saved 29th may then one after for the 1st and then one for the 30th that would go to some proof that the sytem was messed
is it windows 7
control panel, all control items performance information and tools, advanced tools and click view performance in event log
if the time and date was set wrong it will log it (when I reset bios it reset date and time)
post #3 of 13
Thread Starter 
Thanks, so this would only be viable if there was a saved system restore before and after the few minutes it took to create the document on their PC?
Murder Box II
(18 items)
 
Home PC
(15 items)
 
 
CPUMotherboardGraphicsRAM
Intel 6800K Asus X99-A II Zotac 1080Ti AMP Extreme Edition G. Skill Trident Z - 32GB/ 3200Hz/CL14/Quad  
Hard DriveCoolingOSMonitor
Sandisk Extreme Pro 480GB Corsair H100i V2 - w/ML120 Pro Fans Windows 10 Home 64 Bit Acer Z35P 1440P G-Sync 
KeyboardPowerCaseMouse
Steelseries Merc  EVGA Supernova G2 1000W Corsair 450D Mionix Naos 8200 
Mouse PadAudioAudioOther
Inwin Batmat Aluminum Sound Blaster Z Logitech Z906 - 5.1 Maxnomic Commander S-III Gaming Chair 
CPUMotherboardGraphicsRAM
Intel G3440 Asus B85M-E/CSM EVGA GTX 950 Patriot Viper 3 - 2x8GB 1600hz 
Hard DriveOptical DriveCoolingOS
Samsung EVO 850 - 500GB + 4TB/3TB x 2/2TB WD Green LG CH12LS28 Bluray Scythe Big Shuriken 2 w/Corsair SP120 Fan Windows 10 64 Bit 
MonitorKeyboardPowerCase
Samsung 75" TV.... GooBang Doo MX3 Corsair CX430 V2 NMEDIAPC HTPC 6000B w/ Pro LCD Module 
Mouse
GooBang Doo MX3 
  hide details  
Reply
Murder Box II
(18 items)
 
Home PC
(15 items)
 
 
CPUMotherboardGraphicsRAM
Intel 6800K Asus X99-A II Zotac 1080Ti AMP Extreme Edition G. Skill Trident Z - 32GB/ 3200Hz/CL14/Quad  
Hard DriveCoolingOSMonitor
Sandisk Extreme Pro 480GB Corsair H100i V2 - w/ML120 Pro Fans Windows 10 Home 64 Bit Acer Z35P 1440P G-Sync 
KeyboardPowerCaseMouse
Steelseries Merc  EVGA Supernova G2 1000W Corsair 450D Mionix Naos 8200 
Mouse PadAudioAudioOther
Inwin Batmat Aluminum Sound Blaster Z Logitech Z906 - 5.1 Maxnomic Commander S-III Gaming Chair 
CPUMotherboardGraphicsRAM
Intel G3440 Asus B85M-E/CSM EVGA GTX 950 Patriot Viper 3 - 2x8GB 1600hz 
Hard DriveOptical DriveCoolingOS
Samsung EVO 850 - 500GB + 4TB/3TB x 2/2TB WD Green LG CH12LS28 Bluray Scythe Big Shuriken 2 w/Corsair SP120 Fan Windows 10 64 Bit 
MonitorKeyboardPowerCase
Samsung 75" TV.... GooBang Doo MX3 Corsair CX430 V2 NMEDIAPC HTPC 6000B w/ Pro LCD Module 
Mouse
GooBang Doo MX3 
  hide details  
Reply
post #4 of 13
Do you have an IT department? Are you the IT department?
In my work my IT guys use data recovery tools to rebuild documents. Within those tools you can find data like you are looking for.
I don't actually know what we use, some super expensive program I'm sure, I work for a large company. Just a suggestion to check with IT if you have it.

I also dug up this MS article, may be useful.
http://support.microsoft.com/kb/922119
Rig 2.0
(16 items)
 
  
CPUMotherboardGraphicsRAM
i7 3770k Asus P8Z77-V EVGA GTX780 SC ACX Samsung DDR 3 (2 DIMMS) MV-3V4G3D/US 
Hard DriveHard DriveOptical DriveCooling
Samsung 830 SSD WD Caviar Black Asus DVD/RW Xigmatek s-1283 HDT (Air Cooling) 
CoolingCoolingOSMonitor
Scythe Slipstream 1200RPM (x2) Antec 140mm + Antec 120mm + Xigmatek 120mm (x2) Win 7 64bit Acer S243HL bmii - 24" 
PowerCaseMouseAudio
Corsair TX750 Corsair Carbide 300R MX 518 Auzentek X-Fi Forte 7.1 
  hide details  
Reply
Rig 2.0
(16 items)
 
  
CPUMotherboardGraphicsRAM
i7 3770k Asus P8Z77-V EVGA GTX780 SC ACX Samsung DDR 3 (2 DIMMS) MV-3V4G3D/US 
Hard DriveHard DriveOptical DriveCooling
Samsung 830 SSD WD Caviar Black Asus DVD/RW Xigmatek s-1283 HDT (Air Cooling) 
CoolingCoolingOSMonitor
Scythe Slipstream 1200RPM (x2) Antec 140mm + Antec 120mm + Xigmatek 120mm (x2) Win 7 64bit Acer S243HL bmii - 24" 
PowerCaseMouseAudio
Corsair TX750 Corsair Carbide 300R MX 518 Auzentek X-Fi Forte 7.1 
  hide details  
Reply
post #5 of 13
Quote:
Originally Posted by Robilar View Post

Thanks, so this would only be viable if there was a saved system restore before and after the few minutes it took to create the document on their PC?
2nd option may be viable as I said, ive just changed the dayte in windows to 2012 saved a pic and it says
created 15th april 2013 modified 14 dec 2012 accesed 15th april
so it couldn't be done with the date changed in the windows it would have to be the bios
post #6 of 13
Quote:
Originally Posted by Robilar View Post

Thanks, so this would only be viable if there was a saved system restore before and after the few minutes it took to create the document on their PC?

 

Correct, if the computer was since wiped that it was created on, then you couldn't prove the proper creation date. On the same note though, they couldn't prove the creation either once you bring up the workaround for creating a document on a system with the wrong date/time. This is when you can argue that without a proper document handling system that is tamper proof, they can't proive the document was created when it was.
CHILZ - Lan Rig
(17 items)
 
CANARY - Main Rig
(16 items)
 
CADILLAC - HTPC
(14 items)
 
CPUMotherboardGraphicsRAM
Intel i5-4570s Asus H97M-Plus AMD R9 280 G.Skill RipjawsX 16 GB (2x8) 
Hard DriveHard DriveHard DriveCooling
250 GB Samsung 840 240 GB Kingston 3 TB USB 3.0 Drive Custom Loop 
OSMonitorKeyboardPower
Windows 10 Preview BenQ GL2450 Filco MajesTouch2 Ninja PC P&C Silencer Mk III 600 W 
CaseMouseMouse PadAudio
Fractal Design Core 1000 Mionix Castor Monoprice XXL JL Amps + Custom Morel Bookshelf speakers 
Other
Scythe Kama-Panel 3 
CPUMotherboardGraphicsRAM
FX-8150 @ 4.6 GHz Fatal1ty 990FX Pro 9800 GTX+ 512 MB G.Skill Ripjaws X 1866 CL9 
Hard DriveHard DriveCoolingOS
120 GB OCZ Vertex 3 1 TB WD Black 5x 120mm + MCP350 + EK Supreme HF + MicroRes Windows 8 Consumer Preview 
MonitorKeyboardPowerCase
2x Dell U2212HM Logitech G110 Cooler Master 850W Silent Pro Cooler Master 690 II Adv. 
MouseMouse PadAudio
Razer Death Adder 3.5G Staples Gel Cushion Asus Xonar DG + Senn. PC333D 
CPUMotherboardGraphicsRAM
Q6600 Acer X1800 ATI 5670 2 GB Kingston 
Hard DriveOptical DriveOSMonitor
2 TB WD Green Asus BD-R Windows 7 Home Premium Sony 50" LCD 
KeyboardPowerCaseMouse
Acer Media 220 W SFF Acer X1800 Acer Optical 
Mouse PadAudio
The TV cabinet Denon 2808 7.1 AVR + Dahlquist 350W 8" Sub + Kl... 
  hide details  
Reply
CHILZ - Lan Rig
(17 items)
 
CANARY - Main Rig
(16 items)
 
CADILLAC - HTPC
(14 items)
 
CPUMotherboardGraphicsRAM
Intel i5-4570s Asus H97M-Plus AMD R9 280 G.Skill RipjawsX 16 GB (2x8) 
Hard DriveHard DriveHard DriveCooling
250 GB Samsung 840 240 GB Kingston 3 TB USB 3.0 Drive Custom Loop 
OSMonitorKeyboardPower
Windows 10 Preview BenQ GL2450 Filco MajesTouch2 Ninja PC P&C Silencer Mk III 600 W 
CaseMouseMouse PadAudio
Fractal Design Core 1000 Mionix Castor Monoprice XXL JL Amps + Custom Morel Bookshelf speakers 
Other
Scythe Kama-Panel 3 
CPUMotherboardGraphicsRAM
FX-8150 @ 4.6 GHz Fatal1ty 990FX Pro 9800 GTX+ 512 MB G.Skill Ripjaws X 1866 CL9 
Hard DriveHard DriveCoolingOS
120 GB OCZ Vertex 3 1 TB WD Black 5x 120mm + MCP350 + EK Supreme HF + MicroRes Windows 8 Consumer Preview 
MonitorKeyboardPowerCase
2x Dell U2212HM Logitech G110 Cooler Master 850W Silent Pro Cooler Master 690 II Adv. 
MouseMouse PadAudio
Razer Death Adder 3.5G Staples Gel Cushion Asus Xonar DG + Senn. PC333D 
CPUMotherboardGraphicsRAM
Q6600 Acer X1800 ATI 5670 2 GB Kingston 
Hard DriveOptical DriveOSMonitor
2 TB WD Green Asus BD-R Windows 7 Home Premium Sony 50" LCD 
KeyboardPowerCaseMouse
Acer Media 220 W SFF Acer X1800 Acer Optical 
Mouse PadAudio
The TV cabinet Denon 2808 7.1 AVR + Dahlquist 350W 8" Sub + Kl... 
  hide details  
Reply
post #7 of 13
Quote:
Originally Posted by axipher View Post

Correct, if the computer was since wiped that it was created on, then you couldn't prove the proper creation date. On the same note though, they couldn't prove the creation either once you bring up the workaround for creating a document on a system with the wrong date/time. This is when you can argue that without a proper document handling system that is tamper proof, they can't proive the document was created when it was.

show them that the documents time and date stamp can be edited and it will throw the evidence out as who to say then they didn't do that
post #8 of 13
Thread Starter 
No I am not IT. This is not a large company item. My spouse is involved in a lawsuit where the landlord she dealt with committed a number of fraudulent actions and then provided documents they indicated were created months before to support their actions, documents she never received.

Her lawyer is not technical in the slightest and we likely won't have to go down this road, the threat of it should be sufficient.
Murder Box II
(18 items)
 
Home PC
(15 items)
 
 
CPUMotherboardGraphicsRAM
Intel 6800K Asus X99-A II Zotac 1080Ti AMP Extreme Edition G. Skill Trident Z - 32GB/ 3200Hz/CL14/Quad  
Hard DriveCoolingOSMonitor
Sandisk Extreme Pro 480GB Corsair H100i V2 - w/ML120 Pro Fans Windows 10 Home 64 Bit Acer Z35P 1440P G-Sync 
KeyboardPowerCaseMouse
Steelseries Merc  EVGA Supernova G2 1000W Corsair 450D Mionix Naos 8200 
Mouse PadAudioAudioOther
Inwin Batmat Aluminum Sound Blaster Z Logitech Z906 - 5.1 Maxnomic Commander S-III Gaming Chair 
CPUMotherboardGraphicsRAM
Intel G3440 Asus B85M-E/CSM EVGA GTX 950 Patriot Viper 3 - 2x8GB 1600hz 
Hard DriveOptical DriveCoolingOS
Samsung EVO 850 - 500GB + 4TB/3TB x 2/2TB WD Green LG CH12LS28 Bluray Scythe Big Shuriken 2 w/Corsair SP120 Fan Windows 10 64 Bit 
MonitorKeyboardPowerCase
Samsung 75" TV.... GooBang Doo MX3 Corsair CX430 V2 NMEDIAPC HTPC 6000B w/ Pro LCD Module 
Mouse
GooBang Doo MX3 
  hide details  
Reply
Murder Box II
(18 items)
 
Home PC
(15 items)
 
 
CPUMotherboardGraphicsRAM
Intel 6800K Asus X99-A II Zotac 1080Ti AMP Extreme Edition G. Skill Trident Z - 32GB/ 3200Hz/CL14/Quad  
Hard DriveCoolingOSMonitor
Sandisk Extreme Pro 480GB Corsair H100i V2 - w/ML120 Pro Fans Windows 10 Home 64 Bit Acer Z35P 1440P G-Sync 
KeyboardPowerCaseMouse
Steelseries Merc  EVGA Supernova G2 1000W Corsair 450D Mionix Naos 8200 
Mouse PadAudioAudioOther
Inwin Batmat Aluminum Sound Blaster Z Logitech Z906 - 5.1 Maxnomic Commander S-III Gaming Chair 
CPUMotherboardGraphicsRAM
Intel G3440 Asus B85M-E/CSM EVGA GTX 950 Patriot Viper 3 - 2x8GB 1600hz 
Hard DriveOptical DriveCoolingOS
Samsung EVO 850 - 500GB + 4TB/3TB x 2/2TB WD Green LG CH12LS28 Bluray Scythe Big Shuriken 2 w/Corsair SP120 Fan Windows 10 64 Bit 
MonitorKeyboardPowerCase
Samsung 75" TV.... GooBang Doo MX3 Corsair CX430 V2 NMEDIAPC HTPC 6000B w/ Pro LCD Module 
Mouse
GooBang Doo MX3 
  hide details  
Reply
post #9 of 13
If you can show that the date of a MS Word doc can be easily manipulated and there are no physical signed and dated copies of said agreement then the Judge should throw out that material.
As far as I am aware electronic non-signed documents are non binding and mean nothing in court.
Rig 2.0
(16 items)
 
  
CPUMotherboardGraphicsRAM
i7 3770k Asus P8Z77-V EVGA GTX780 SC ACX Samsung DDR 3 (2 DIMMS) MV-3V4G3D/US 
Hard DriveHard DriveOptical DriveCooling
Samsung 830 SSD WD Caviar Black Asus DVD/RW Xigmatek s-1283 HDT (Air Cooling) 
CoolingCoolingOSMonitor
Scythe Slipstream 1200RPM (x2) Antec 140mm + Antec 120mm + Xigmatek 120mm (x2) Win 7 64bit Acer S243HL bmii - 24" 
PowerCaseMouseAudio
Corsair TX750 Corsair Carbide 300R MX 518 Auzentek X-Fi Forte 7.1 
  hide details  
Reply
Rig 2.0
(16 items)
 
  
CPUMotherboardGraphicsRAM
i7 3770k Asus P8Z77-V EVGA GTX780 SC ACX Samsung DDR 3 (2 DIMMS) MV-3V4G3D/US 
Hard DriveHard DriveOptical DriveCooling
Samsung 830 SSD WD Caviar Black Asus DVD/RW Xigmatek s-1283 HDT (Air Cooling) 
CoolingCoolingOSMonitor
Scythe Slipstream 1200RPM (x2) Antec 140mm + Antec 120mm + Xigmatek 120mm (x2) Win 7 64bit Acer S243HL bmii - 24" 
PowerCaseMouseAudio
Corsair TX750 Corsair Carbide 300R MX 518 Auzentek X-Fi Forte 7.1 
  hide details  
Reply
post #10 of 13
Thread Starter 
That is the stance we are taking. They (the landlords) have asserted that they hand delivered this notice to the business (without a signature). They later provided a copy of the notice as part of their evidence package.

This is not typically a document that both parties would sign. Our point is that a) we have no record or recollection that they delivered it (and the burden of proof is on them given there was no signature) and b) that this was a last minute thing as opposed to a document created a month and a half prior (which is what they have stated).

These guys are huge scumbags to begin with and I have no doubt that they will quite happily manufacture evidence as needed.
Murder Box II
(18 items)
 
Home PC
(15 items)
 
 
CPUMotherboardGraphicsRAM
Intel 6800K Asus X99-A II Zotac 1080Ti AMP Extreme Edition G. Skill Trident Z - 32GB/ 3200Hz/CL14/Quad  
Hard DriveCoolingOSMonitor
Sandisk Extreme Pro 480GB Corsair H100i V2 - w/ML120 Pro Fans Windows 10 Home 64 Bit Acer Z35P 1440P G-Sync 
KeyboardPowerCaseMouse
Steelseries Merc  EVGA Supernova G2 1000W Corsair 450D Mionix Naos 8200 
Mouse PadAudioAudioOther
Inwin Batmat Aluminum Sound Blaster Z Logitech Z906 - 5.1 Maxnomic Commander S-III Gaming Chair 
CPUMotherboardGraphicsRAM
Intel G3440 Asus B85M-E/CSM EVGA GTX 950 Patriot Viper 3 - 2x8GB 1600hz 
Hard DriveOptical DriveCoolingOS
Samsung EVO 850 - 500GB + 4TB/3TB x 2/2TB WD Green LG CH12LS28 Bluray Scythe Big Shuriken 2 w/Corsair SP120 Fan Windows 10 64 Bit 
MonitorKeyboardPowerCase
Samsung 75" TV.... GooBang Doo MX3 Corsair CX430 V2 NMEDIAPC HTPC 6000B w/ Pro LCD Module 
Mouse
GooBang Doo MX3 
  hide details  
Reply
Murder Box II
(18 items)
 
Home PC
(15 items)
 
 
CPUMotherboardGraphicsRAM
Intel 6800K Asus X99-A II Zotac 1080Ti AMP Extreme Edition G. Skill Trident Z - 32GB/ 3200Hz/CL14/Quad  
Hard DriveCoolingOSMonitor
Sandisk Extreme Pro 480GB Corsair H100i V2 - w/ML120 Pro Fans Windows 10 Home 64 Bit Acer Z35P 1440P G-Sync 
KeyboardPowerCaseMouse
Steelseries Merc  EVGA Supernova G2 1000W Corsair 450D Mionix Naos 8200 
Mouse PadAudioAudioOther
Inwin Batmat Aluminum Sound Blaster Z Logitech Z906 - 5.1 Maxnomic Commander S-III Gaming Chair 
CPUMotherboardGraphicsRAM
Intel G3440 Asus B85M-E/CSM EVGA GTX 950 Patriot Viper 3 - 2x8GB 1600hz 
Hard DriveOptical DriveCoolingOS
Samsung EVO 850 - 500GB + 4TB/3TB x 2/2TB WD Green LG CH12LS28 Bluray Scythe Big Shuriken 2 w/Corsair SP120 Fan Windows 10 64 Bit 
MonitorKeyboardPowerCase
Samsung 75" TV.... GooBang Doo MX3 Corsair CX430 V2 NMEDIAPC HTPC 6000B w/ Pro LCD Module 
Mouse
GooBang Doo MX3 
  hide details  
Reply
New Posts  All Forums:Forum Nav:
  Return Home
  Back to Forum: Windows
Overclock.net › Forums › Software, Programming and Coding › Operating Systems › Windows › Been asked to testify in a court case, could use some advice