Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Here's the situation: I went on vacation for a couple of weeks, but before I left, I took the harddrive out of my computer and hid it in a different location. Upon coming back on Monday and putting the harddrive back in my computer, I right-clicked on different files to see their properties. Interestingly enough, several files had been accessed during the time I was gone! I right-clicked different files in various locations on the harddrive, and all of these suspect files had been accessed within a certain time range (Sunday, ‎January ‎09, ‎2011, approximately ‏‎between 6:52:16 PM - 7:16:25 PM). Some of them had been accessed at the exact same time--down to the very second. This makes me think that someone must have done a search on my harddrive for certain types of files and then copied all those files to some other medium. The Windows 7 installation on this harddrive is password protected, but NOT encrypted, so they could have easily put the harddrive into an enclosure/toaster to access it from a different computer.

Of course I did not right-click every single file on my computer, but I did so in different folders. For instance, one of the folders I went through has different types of files: .mp3, ,prproj, .3gp, .mpg, .wmv, .xmp, .txt with file-sizes ranging from 2 KB to 29.7 MB (there is also a sub-folder in this folder which contains only .jpg files); however, of all these different types of files in this folder and its subfolder, all of them had been accessed (including the .jpg files from the sub-folder) EXCEPT the .mp3 files (if it makes any difference, the .mp3 files in this folder range in size from 187 KB to 4881 KB). Additionally, this sub-folder which contained only .jpg files (48 .jpg files to be exact) was not accessed during this time--only the .jpg files within it were accessed-- (between 6:57:03 PM - 6:57:08 PM).

I thought that perhaps this was some kind of Windows glitch that was displaying the wrong access date, but then I looked at the "date created" and "date modified" for all of these files in question, and their created/modified dates and times were spot on correct.

My first thought was that someone put the harddrive into an enclosure/toaster and viewed the files; but then I realized that this was impossible because several of the files had been accessed at the same exact time down to the second. So this made me think that the only other way the "date accessed" could have changed would have been if someone copied the files.

Is there any chance at all whatsoever that this is some kind of Windows glitch or something, or is it a fact that someone was indeed accessing my files (and if someone was accessing my files, am I right about the files in question having been copied)? Is there any other possibility for what could have happened?

Do I need to use any kinds of forensics tools to further investigate this matter (and if so, which tools), or is there any other way in which I can be certain of what took place in that timeframe the day before I got back? Or is what I see with Windows 7 good enough (that is, accurate and truthful)?

share|improve this question

2 Answers 2

Firstly, it depends on the filesystem on the drive. It's probably NTFS (FAT being worse).

Time of last access on an NTFS volume is not very accurate.

This is an extract of the MSDN pages about file times:

Not all file systems can record creation and last access times, and not all file systems record them in the same manner. For example, the resolution of create time on FAT is 10 milliseconds, while write time has a resolution of 2 seconds and access time has a resolution of 1 day, so it is really the access date. The NTFS file system delays updates to the last access time for a file by up to 1 hour after the last access.

There is a lot more information here: http://msdn.microsoft.com/en-us/library/ms724290(v=vs.85).aspx

In addition, from here: http://msdn.microsoft.com/en-us/library/aa365739(v=vs.85).aspx

ftLastAccessTime A FILETIME structure.

For a file, the structure specifies when the file is last read from or written to.

For a directory, the structure specifies when the directory is created.

For both files and directories, the specified date is correct, but the time of day is always set to midnight. If the underlying file system does not support last access time, this member is zero.

All this leads me to think that the last access time is firstly pretty inaccurate, and secondly the writing of an update to that time to the media can be deferred by up to an hour making the trustworthiness of this attribute fairly suspect.

share|improve this answer

I use last accessed-created date time stamps all the time when troubleshooting-investigating software installs. It's been very accurate in my uses of it in NTFS file systems.

Since some of the dates are changed while you were gone, I assume it was several days to a week, I would say someone did access those files.

These timestamps along with other data are used by computer forensics teams to reconstruct what a user did on a computer.

Experienced hackers use software to alter these time stamps to cover their tracks when breaking into computer systems.

Last accessed is disabled by default in Windows 7.

share|improve this answer
    
Will the last accessed date change when we copy a file/folder? –  Pacerier Nov 22 at 15:54

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.