1

Is there anyway of verifying the genuine age (date created) of a file. I know that when you copy and paste from one system to another the date can change, and dates change when files are attached as email, but is there anyway to track the original date created of a file.

Thanks

James

2 Answers 2

1

This depends on a lot of factors.

If, like you say, the file is copied between systems, it's up to the OS and the "copying agent" in question to determine what to use as creation-time: The creation time of the original system? The creation time on the local system? In addition, this can usually be overridden, such as with rsync you have the -t switch which will make it preserve the original modification time.

To determine the creation time in a reliable way, you have to look at each step along the way and ensure that the original creation time has been preserved. Depending on the file type, there might also be some meta-data in the file relating to its age.

1

The short answer is "no" - given only an existing file you cannot tell if its "creation date" really corresponds to the date when the file was first created. Like you said, a lot of programs (email clients, file managers, archivers etc.) can replace this date with (usually) a new value at some point.

Many file types have headers (EXIF in jpeg pictures, metadata in MS office documents etc) which preserve the original creation date, unless these headers were intentionally modified or removed.

0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .