Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I am trying to prove creation dates when users were created on a Mac OSX computer. Some dates go back to 2009 (which would be when the computer was first used) and some overlap in 2012.

I also have two user accounts: John and Johnnew_user

Does this indicate that the original was deleted and a new User account created that overwrote the original?

share|improve this question

1 Answer 1

If you are doing computer forensics and want to use this information in court this two-letter word gives you the answer:

NO!

Unless a strong certified security mechanism is put in place no one can prove nobody else hacked the computer, mounted the HDD on a separate machine and messed up with files containing dates. Only if files were timestamped by third-party authority you would gain proof benefit.

The fact that you have accounts named like that doesn't prove anything, at least if somebody wants you to believe an account was deleted.

It doesn't prove but suggests that somebody couldn't create another account named John and named his new account Johnnew_user

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.