Windows 7, file properties - Is "date accessed" ALWAYS 100% accurate?

Hello,
Here's the situation: I went on vacation for a couple of weeks, but before I left, I took the harddrive out of my computer and hid it in a different location. Upon coming back on Monday (January 10, 2011) and putting the harddrive back in my computer, I
right-clicked on different files to see their properties. Interestingly enough, several files had been accessed during the time I was gone! I right-clicked different files in various locations on the harddrive, and all of these suspect files had been accessed
within a certain time range (Sunday, ‎January ‎09, ‎2011, approximately ‏‎between 6:52:16 PM - 9:06:05 PM). Some of them had been accessed at the exact same time--down to the very second. This makes me think that someone must have done
a search on my harddrive for certain types of files and then copied all those files to some other medium. The Windows 7 installation on this harddrive is password protected, but NOT encrypted, so they could have easily put the harddrive into an enclosure/toaster
to access it from a different computer.
Of course I did not right-click every single file on my computer, but did so in different folders. For instance, one of the folders I went through has different types of files: .mp3, ,prproj, .3gp, .mpg, .wmv, .xmp, .txt with file-sizes ranging from 2 KB
to 29.7 MB (there is also a sub-folder in this folder which contains only .jpg files); however, of all these different types of files in this folder and its subfolder, all of them had been accessed (including the .jpg files from the sub-folder) EXCEPT the
.mp3 files (if it makes any difference, the .mp3 files in this folder range in size from 187 KB to 4881 KB). Additionally, this sub-folder which contained only .jpg files (48 .jpg files to be exact) was not accessed during this time--only the .jpg files within
it were accessed-- (between 6:57:03 PM - 6:57:08 PM).
I thought that perhaps this was some kind of Windows glitch that was displaying the wrong access date, but then I looked at the "date created" and "date modified" for all of these files in question, and their created/modified dates and
times were spot on correct.
My first thought was that someone put the harddrive into an enclosure/toaster and viewed the files; but then I realized that this was impossible because several of the files had been accessed at the same exact time down to the second. So this made me think
that the only other way the "date accessed" could have changed would have been if someone copied the files.
Is there any chance at all whatsoever that this is some kind of Windows glitch or something, or is it a fact that someone was indeed accessing my files (and if someone was accessing my files, am I right about the files in question having been copied)? Is
there any other possibility for what could have happened?
Do I need to use any kinds of forensics tools to further investigate this matter (and if so, which tools), or is there any other way in which I can be certain of what took place in that timeframe the day before I got back? Or is what I see with Windows 7
good enough (i.e. accurate and truthful)?
Thanks in advance, and please let me know if any other details are required on my part.
P.S. The harddrive is NTFS.

Never mind.  Someone else already answered this for me:
"I use last accessed-created date time stamps all the time when troubleshooting-investigating software installs, its been very accurate in my uses of it in NTFS file systems.
Since some of the dates are while you were gone, I assume it was several days to a week, I would say someone did access those files.
These timestamps along with other data are used by computer forensics teams to reconstruct what a user did on a computer.
Experienced Hackers use software to alter these time stamps to cover their tracks when breaking into computer systems."
http://superuser.com/questions/232143/windows-7-file-properties-is-date-accessed-always-100-accurate/232320#232320
Additionally, I just now found out what happened. Someone else found the harddrive and thought it was theirs (since it was identical to one they had been missing), so they put it in their computer and scanned it with an anti-virus software. They realized it
wasn't theirs and then put it back in the place I had hidden it.
In my original question, I stated a possible theory that someone may have copied the files, but I later realized that copying in itself doesn't affect the "date accessed" of the original/source file, but rather only the "date accessed" of
the copy.
Thanks to all those that may have read my question.

Similar Messages

  • I have downloaded the latest version of icloud control panel to a PC with Windows 7. My "master" data is always on my PC. With other synch software I always select "One Way Outlook to Device". I synched icloud with Outlook and it has trashed my Outlook

    I have downloaded the latest version of icloud control panel to a PC with Windows 7. My "master" data is always on my PC. With other synch software I always select "One Way Outlook to Device". I synched icloud with Outlook and it has trashed my Outlook with duplicate contacts. Is there a solution. Is there selective synchronisation available?

    Make sure you don't have any notes that have no content or subject or this can prevent syncing with Outlook.  If you do, delete them.
    If you don't, try unchecking "Mail,Contacts,Calendars & Tasks with Outlook" on the iCloud control panel for Windows, choose Delete at the prompt (the data will still be in iCloud), restart your PC, then go back and check this setting again.  (Your iCloud data will reappear in Outlook after a brief delay as it redownloads.)
    Then create a new note on one of your iOS devices and see if it appears in the Notes folder in Outlook mail after a few minutes.

  • File properties: mysterious dates for created, modified and last opened

    I've seen this ever since I started using my Mac - I am a relatively new Mac user (a year or more vs. well, decades on Win/PC).
    Finder: click on a file and it will show its properties. It will have a "More info" button.
    The dates displayed between the 2 above are different.
    1) In the "immediate" display it would say something like:
    Last opened: Today at 10PM
    - this wrong day, "correct" time
    - considering that it will display this at say 7AM "today"...well, it's a "future" date/time
    2) If you click the More info button, the "truth" comes out
    Last opened: Yesterday at 10PM (accurate)
    Never really cared, but thought I'd ask here. At some point, if I start some development on the Mac, and filesystems, file properties are involved, this will obviously be an issue. I don't even know if this affects file searching based on these properties - again, new user, using Mac for very specific purpose, but usage is definitely on the rise, so I'd like to get some direction on very basic OS behavior like this fully understood.
    Thanks and happy new year to all!

    EdSF wrote:
    Thanks VK. I'm the only user.
    Can you please clarify on what user accounts have to do with this behavior?
    I've seen many times when corrupt date settings in the global user preference file cause wrong modified dates to be displayed in finder. in that case if you make a different user they will be displayed correctly. the file in question is ~/library/preferences/.GlobalPreferences.plist.
    It's ok to be technical in your response....if it goes over my head, I'll be frank and ask for clarification....
    - Is it a user-defined preference/setting?
    - It's almost like a busted UTC/time zone routine (somehow "TODAY" is UTC, but the time value doesn't match) re: 10PM last night on PT is/was "today" in UTC....

  • Best way to port all Windows XP files, applicaitons and data form my PC over to iMac and how to run those Windows apps on Mac?ns on Mac?

    I have a Windows XP machine with apps, files and data.  I want to get all that over to my Mac, and also run those apps under Windows XP or even Windows 7 on my Mac.  Im wondering:
    1.  How best to get those files over to my Mac
    2.  How to run those apps and use my Windows based files/data on my Mac
    3.  How best to run Windows on my Mac....either partitiion my Mac's hard drive and boot up either Windows or MAC OS, or run some other program where I can easily switch back and forth form Windows to MAC OS, or perhaps get it all on an external hard drive, maybe partition that Windows/MAC OS and boot from that?
    Thanks!

    I agree you would benefit by using virtualizaiton software. Virtual Box is one alternative the commercial apps for doing virtualization are Parallels and VMWare Fusion which you also might be interested in for their support and updates.
    Also you may benefit by book marking and using:
    Mac 101 , Switch 101 & Find Out How Video tutorials
    For your MS Office apps then I'd STRONGLY recommend using the native Office For Mac versions, you can find these on Amazon for less than $100 and then you can run the apps natively rather than having to lean on MS Windows. Also for your Financial and Tax software you also may want to use OS X apps too, for example I used Quicken for over 20 years (PC mostly and some Mac) but switched to iBank. Also for tax software I have used Quicken's Turbo Tax, this also runs natively on OS X.
    In other words for your stated needs I don't see much reason to stay with MS Windows. You may have other considerations, if you do please state them, some may be real issues and some may be easily overcome.

  • Why isn't ratings information set in lightroom showing up in windows explorer file properties?

    I am using Lightroom 3.4 64 bit on Windows7 64 bit.  When I apply keywords and set a rating in lightroom, only the keywords show up in the file properties in windows explorer, and FastStone viewer.  The ratings information is not shown.  Is this a known problem, or is there a way to fix it?

    I am using Lightroom 3.4 64 bit on Windows7 64 bit. When I apply keywords and set a rating in lightroom, only the keywords show up in the file properties in windows explorer, and FastStone viewer. The ratings information is not shown.
    Hmm, are you remembering to do Metadata > Save Metadata To File after you change the rating in LR?
    LR and Windows 7, Vista, and even XP (if you install Windows Live Photo Gallery) share metadata using industry-standard fields, and Windows' manipulation of the metadata is pretty robust.  In particular, they'll share the rating via the metadata field XMP:Rating.  I just verified this with LR 3.4 and Windows 7, but I'm pretty sure it also applies to earlier versions of LR 3:
    1. In LR 3.4, change the rating of an image.
    2. Metadata > Save Metadata To File
    3. In Windows Explorer, right-click the image file and select Properties.
    4. Observe the new rating on the Details tab.
    5. Change the rating on the Details tab.
    6. In LR, do Metadata > Read Metadata From File.  Observe the new rating in LR.

  • Wav - windows media file properties

    hi all, is there a way to get properties from a .wav (windows media) file? for example, the time duration of the media?
    thanks in advance.
    Giovani Salvador

    hi Giovani,
    hope this helps:
    (from http://java.sun.com/products/java-media/jmf/2.1.1/guide/JMFPresenting.html#93867)
    Getting the Duration of the Media Stream
    Since programs often need to know how long a particular media stream will run, all Controllers implement the Duration interface. This interface defines a single method, getDuration. The duration represents the length of time that a media object would run, if played at the default rate of 1.0. A media stream's duration is only accessible through a Player.
    If the duration can't be determined when getDuration is called, DURATION_UNKNOWN is returned. This can happen if the Player has not yet reached a state where the duration of the media source is available. At a later time, the duration might be available and a call to getDuration would return the duration value. If the media source does not have a defined duration, as in the case of a live broadcast, getDuration returns DURATION_UNBOUNDED.
    There are some other ways to control the duration of the media. For example, if you need to wait the media stream to finish, you can listen for StopEvent, EndOfMediaEvent...

  • File Properties (Meta Data) and Indexing

    Meta Edit™
    Find what you need, when you need it.
    If you manage a large network or portal, chances are that there are thousands of documents floating around that are difficult to locate due to poor file property information.
    With MetaEdit™, it’s easy to gain the control you seek and create rich document repositories you can count on.
    At it’s core, MetaEdit™ is a simple and easy-to-use software solution that allows users to quickly search, index, modify and maintain the META properties of ALL your files, such as Author, Company Name, etc…
    It’s EASY! Simply set a base folder to scan, then let MetaEdit™ do the work of gathering all the related meta information for you to efficiently manage and edit.
    Why wait? Maximize the value of your information today.
    For more detailed information and a FREE demo, visit http://www.spheric.ca/MetaEdit.aspx

    File -> Library -> Import playlist and select the old .XML file.

  • File Properties (Meta Data) and Indexing for your Portal

    Meta Edit™
    Find what you need, when you need it.
    If you manage a large network or portal, chances are that there are thousands of documents floating around that are difficult to locate due to poor file property information.
    With MetaEdit™, it’s easy to gain the control you seek and create rich document repositories you can count on.
    At it’s core, MetaEdit™ is a simple and easy-to-use software solution that allows users to quickly search, index, modify and maintain the META properties of ALL your files, such as Author, Company Name, etc…
    It’s EASY! Simply set a base folder to scan, then let MetaEdit™ do the work of gathering all the related meta information for you to efficiently manage and edit.
    Why wait? Maximize the value of your information today.
    For more detailed information and a FREE demo, visit http://www.spheric.ca/MetaEdit.aspx

    Acath?
    (1) Why would you need to change the color in HTML when you can specify it in Catalyst (Artboard Size & Color)?
    (2) I think the question was about specifying an "Image"... you can't in Catalyst, but is there any plan for beta 3?
    (3) Can you put a tranparent Artboard in Catalyst and specify a background image in the HTML?
    Thanks
    Roger

  • Script to enumerate, and interactively modify File Properties (eg. meta-data)

    Hey Script Guys:
    I am analyzing SharePoint capabilities for a customer and there are some things that they need that is not there, but so far it seems it is but can't be seen.
    First two things are:
    'Stored Procedures' - That is a way from within a rule or workflow to interact with an interpretive host.  Right now I use REXX, which has the INTERPRET function.  I can write a script into a text element, send it there, and get the results.  Handy,
    but rough.  This is especially handy in validation situations, or re-mapping of data.
    A way for metadata to be plugged into a file easily without using the Properties dialog (like read it from document fields, etc) so the Content Routing can be cleaned-up to be more fully automated.
    Bear in mind I grew-up on Motorola Assembler, BAL and MASM to develop  ASIC's, process controllers, operating systems and compilers, so alot of this shell programming is still a little weird.  Be nice
    JgEarl (FOG) sends...

    File properties in WIndows are not part of the file. Some are part of the directory entry like the LastWriteTime and ReadOnly flag.
    In Windows Explorer file properties like the internal properties of an MSWord document or an Adobe PDF file can be exposed if the vendor provides a support DLL that Explorer can use to expose these. They are not normally available to any program directly. 
    They are only available via the "Shell" (Explorer) or via the application that manages the document.
    In SharePoint the "library" or other container manages a set or properties defined by SharePoint.  For MS documents we may be able to use "shell" methods to tattoo the SharePoint library with this information.
    None of this has much of anything to do with scripting.  It is e3xternal to the scripting system and can be accessed by the product specific support DLL such as the dll installed by MSWord and Adobe.
    To access these things through the shell in script we must instantiate the "Shell" object.  In SharePoint we can do this prior to loading the document or we can load documetns that Sharepointas nan installed DLL for.
    At this time I am not sure as to how SP does this.  I recommend posting in the SharePoint developer forum for information on how to access and build these extensions DLLs.  I believe you can also look it up in the SharePoint SDK.
    Outside of serverside code or using a custom library I do not see how you can do this.
    You can, of course, always generate a file of name/value pairs describing your files.  You can also add almost anything to the SharePoint library structure or create custom types to display your custom metadata.
    ¯\_(ツ)_/¯

  • The Date Accessed attribute is resetting to all the files in a folder

    Hi all,
    I have an issue that the "Date Accessed" attribute is often resetting to all the files in a folder if i open single file as this folder is from File server mapped as Drive to me. This is happening to all the users whoever connect to that fileserver
    and i see same issue from RDP as well. is there any option to check which is resetting the "Date Accessed" attribute to all the files. The Date Access attribute is simillar to Date accessed and Date modified. We need to fix this issue as it is related
    to security concern for us. The file server is windows 2008 R2 and the client machines are windows 7.
    Side note: I can see that there is no software, antivirus, offline sycn is causing this issue.
    Thank you,
    Sampath
    P.Sampath

    Hi,
    It seems that some specific process accessed the files and updated the attribute. You could configure auditing on the shared folder. Then you can go through the auditing log to check which process is doing the read operation on all these files. 
    Configuring Audit Policies
    http://technet.microsoft.com/en-us/library/dd277403.aspx
    Best Regards,
    Mandy
    We
    are trying to better understand customer views on social support experience, so your participation in this
    interview project would be greatly appreciated if you have time.
    Thanks for helping make community forums a great place.

  • CS4 Matching Metadata to File Properties

    Is there a way in Bridge's Metadata to either see or modify Window's File Properties?  Specificaly Subject or Comment?
    I am scanning old family photos and what to document what is written on the back plus who is in the photo.  I know I can tag them with the people, but that doesn't really tell me who is who when it is a large group.... I was hoping not to clutter the "title" with the place, people, event, and other comments.
    I will be sharing these photos with people that do not own Bridge, so Window's file properties is where I need to have the information stored.  Thank you!

    If you click on file/file info you can enter what ever you want in description.  This field and keywords (tags) can be read in Windows Explorer.

  • Outlook 2010 - Data File Properties/Folder Size verses Windows Explorer pst file size

    I am running Outlook 2010 32bit Version 14.0.6129.5000 on a Windows PC running Windows 7 Professional.  All updates from MS are up to date.
    I have several pst files I open with Outlook 2010. The size of the files displayed in Outlook are very different than what is displayed in Windows Explorer. 
    For example one of the pst file called "business.pst" when opened Outlook displays it under "Data File Properties -> Folder Size" that the Total Size (including subfolders) is 764,354 KB.  Windows Explorer says
    the file size is 1,190,417 KB.
    For some reason MS Outlook 2010 is displaying the wrong folder size.  Any ideas why this is the case?
    Thanks,
    Pat

    Outlook mailbox grows as you create and receive items. When you delete items, the size of the Outlook Data File (.pst and .ost) file might not decrease in proportion to the data that you deleted, untill it has been compacted.
    Normally, after you have deleted items from an Outlook Data File (.pst), the file will be automatically compacted in the background when you’re not using your computer and Outlook is running.
    For an exception, when the Outlook Data File (.pst) is somehow corrupt, the compaction might not finish correctly. So the size of the Outlook Data File (.pst) file might remain the same before compaction.
    To solve this, try run the
    scanpst to fix the Outlook Data File (.pst) file first, after that, we can
    manually start the compact command.
    When finished, compare the file size again.
    Max Meng
    TechNet Community Support

  • Windows File Properties vs. Content Services Properties

    Hi.
    On behalf of a customer I am evaluating Windows file properties vs. CS file properties.
    Client Environment: Windows XP SP2, O-Drive.
    Rightclick a File stored on O (O-Drive, Content Services).
    a Props. Dialog shows up, the first tab is General*. It shows several file
    properties among others the following:
    - Last Access Date: This always shows Wed. 1 Jan 1986 00:00:00
    Does this correspond to any content services file property? If so, why
    is it always 1-jan-1986 00:00.00 and does not change? Is it a bug?
    - Checkboxes Write protected* / Archive* / Hidden*
    Do these correspond to any cs file property? Do these have any effect?
    (I tried write protected, but it did not work as expected, I was able
    to overwrite the file) Bug or Feature?
    If these checkboxes do not work, could these be disabled through O-Drive,
    otherwise users might get confused...
    Regards, Tom
    * (I don't know the exact english labels as I am working on a german client... so
    I translated the german labels - sorry)

    Hi. Sure, here's some collateral information:
    We are evaluating Content Services for several customer projects.
    During a presentation I held 2 weeks ago a customer asked exactly
    those questions and I had to admit I could not answer.
    So I retried on our test instance and checked the docu and still
    could not get a clue how windows attributes and cs attributes correspond.
    Then I asked MJS during last weeks workshop he did not know exactly either.
    Hence I am asking on the forum.
    Regards, Tom
    (PS. If you require further background information you may contact me via email
    or ask E. Neuwirth on Tom Gansor / OPITZ Consulting).

  • Editing metadata in the file properties window

    Hi,
    I’m using Win XP SP3 on a “normal” Desktop-PC. Since my problem is not connected to hardware I think that description is enough but I do not know which software information is required. So you may ask. Important is maybe that I am running Adobe Acrobat and Reader simultaneously on the same machine.
    The problem: I always changed and edited some of the metadata of my PDF files by bringing up the file properties window of the PDF (right click - properties). Next to the “General”-Tab is the “PDF”-Tab. You can see the title, author, topic, dates and PDF-Version of the document. The first four fields where always editable textboxes. I get used to put in some comments and other important information because I didn’t want to use any tool. Now the complete window is locked. Is this because of the new 9.3.3 Reader update? I updated so many times and never anything like this happened. How can I turn back to the old behavior?
    I do not want to edit those information in Acrobat by choosing File and then propertis because it takes much more time because i have to open the file (if it is one its fine) but if there are more where the same info shall be in I'd like to use the built in function of the properties sheet in windows.
    With kind regards
    DragJo

    At first I asked that question by mistake in the wrong forum so I put in it here. But it has been answered there http://forums.adobe.com/message/2973589
    so I mark this as answered, too.

  • Windows native file dialog default sort is by date instead of name

    I somehow managed to get the Windows common file dialog default sort to be by date instead of name, so I have to resort by name every time I select a VI to load. I haven't been able to identify the registry entry that tell how the MRU list is sorted. How do I make the default sort by name instead of date, short of removing and reinstalling LabVIEW?

    I think its a Windows issue and nothing to do with LabVIEW since LabVIEW just calls the MS common dialog. Do you see the same behaviour when using Windows Explorer? I know that with Win2K, I can set the default folder view to always sort by date. To go back to the default, select My Computer>Tools>Folder Options>View>Reset All Folders. I don't have easy access to any computers with a different OS right now so I can't describe what the process is for them.

Maybe you are looking for

  • Nothing is working. what to do? not right since mozilla firefox updated.

    the back arrow in the upper left corner does not work on any page. cannot post comments on facebook. can only access mail and facebook from desktop icon. do not like the way google is set up now nor do I like the bookmarks on the right side of the sc

  • Single flash for switches in stack

    Hi, Is it possible to use a single flash for all the switches in stack? In one of my locations, I found four switches in stack. When I try to check the IOS for all the switches in stack, except in master, all other are not showing any output for sh f

  • RoboHelp HTML will not open at all

    I was running into repeated Visual Studio debugger errors, so I followed some solutions listed here on the forum.  When I logged back onto my machine, I received a User Profile may be corrupt error.  After I logged in, RoboHTML would not launch. No r

  • Eligibility criteria for another certification in case of independent consu

    I been through the certification policy in case of certified professional, however the whole policy revolves around the certified consultants who are working with sap partner companies or client companies. There is no mention about the independent co

  • Selection/Range.MoveEndUntil crashes word when encountering a comment

     have a word add-in that manipulates selected text by reformatting it in various ways (specifics not important). One function not only manipulates the selected text, but also expands the range to include text prior to the users selection up until the