Due to some court cases in my jurisdiction, I often see court-appointed experts determining the creation date of a document. Is it really possible to do this via software methods? How could one prove a creation date if a fake date was used before the document was created?
I know this part doesn't belong to superuser but anyhow I was also curious if any hardware methodology would work (to any precision - day/month/year).
File metadata (e.g. creation date, last modified, etc) is generally a matter of the file system, and can thus be modified using various software tools. In fact, some filesystems don't even track creation date (e.g. ext3 on linux tracks ctime, which is actually an inode change time). The metadata that is tracked will also vary from filesystem to filesystem - some filesystems will allow tracking of last access time, last modified, etc.
The ease of changing this "creation time" (or last modified, last accessed, etc) may vary from file system to file system, but in general, these timestamps are not 100% reliable.
I would imagine in a courtroom environment, one party would try to suggest the last modified times are good due to the user being of a certain ability, other file times matching, etc, while the opposing party would try an point out that file times can be faked. It's unclear to me which side would succeed in convincing a judge or jury as to what likely happened, unless a "smoking gun" of sorts is found that shows inconsistencies with the timestamps (e.g. two files created on the same date have wildly varying dates, or copies of the file were emailed before the supposed creation date, etc).
I'm not aware of any hardware methodologies to track modifications.
DISCLAIMER: IANAL
the first rule of forensics is that all readings are suspect if you take them down to the Nth, so you always need to establish a level of reasonableness by which you accept findings. Yes dates can be modified, but it takes a rather sophisticated user to do it, and they almost certainly need physical access to the system to do it.
There are a number of circumstances where a computer does have to make its best guess on some attributes. For instance, if I copy a file from my SAMBA file server to my workstation, the file creation date is the time I pasted the file, not the time it was initially created. In my case it does maintain the correct modified time, but that may not always be the case.
With journaling filesystems you may have some evidence that file metadata was modified or faked, but that would imply that the filesystem was in control of the modification, which is unlikely. you should always check the contents of backups and perhaps the pagefile and hiberfill.sys to look for copies of the file data that disagree on date infomation.
in the long run, if the suspect is or is connected somehow to a very skilled technician or attacker, then be suspicious of dates. if they barely knows how to rebuild windows and don't know what linux is, then the dates are likely correct, unless an outside agent is in play.
Whoever owns or has [physical] access to the computer can do with it as he or she pleases. Including faking date created files.
The only way for an expert to surely determine such a date is if the document or a copy of it was stored elsewhere in a place managed by a trusted third party.
E.g. somewhere in the cloud, and using that cloud providers backups to check things. Or mailed to someone at date X where the recipient knows that is was created at or before date X.
But anyone with access (either remote or physical) to a computer can change that documents apparent creation date. They might not have the skill to do that, but that is not something any court would accept. (Similar to 'but your honor. I do not know how a gun works. Thus I could not have shot him').
