Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am trying to prove creation dates when users were created on a Mac OSX computer. Some dates go back to 2009 (which would be when the computer was first used) and some overlap in 2012.

I also have two user accounts: John and Johnnew_user

Does this indicate that the original was deleted and a new User account created that overwrote the original?

share|improve this question

If you are doing computer forensics and want to use this information in court this two-letter word gives you the answer:


Unless a strong certified security mechanism is put in place no one can prove nobody else hacked the computer, mounted the HDD on a separate machine and messed up with files containing dates. Only if files were timestamped by third-party authority you would gain proof benefit.

The fact that you have accounts named like that doesn't prove anything, at least if somebody wants you to believe an account was deleted.

It doesn't prove but suggests that somebody couldn't create another account named John and named his new account Johnnew_user

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .