Posted on 04/29/2015 8:15:40 PM PDT by grumpygresh
Question for all freeper computer experts. I have a case where I have reason to believe that my opponent has faked the date and content of a website as it appeared in January through April 2011. I have used the way back machine and found that my opponent did not the information that they claimed to have had on the website between January to April 2011. I have not yet received any paperwork or computer file from my opponent. But when I do get the computer file, could it be faked with respect to the date and content? What would be the best course of action to reveal the fraud?
My company does computer forensics. Yes it can be faked BUT it takes an expert. A website isn’t good proof as its so easy to change. If you have proof that it wasn’t there it’s probably better than anything he has.
Hiring experts to prove or disprove is expensive.
Look for inconsistencies. It’s all files. All stamps the same date time? Examine contents for date,references that don’t jibe. What kind of files? .jsp and htm files have all kinds of meta data. Even word processing documents and pdfs have internal meta data.
Hillary’s server???
Use a forensic expert. To do otherwise can destroy evidence.
I’ve been involved as a litigation consultant in several fraud cases involving computer files. It is very important to create a working copy and not to open the original file provided. Opening the file can change the hash totals.
I don’t know about online data, but with general applications, i.e., Word, Excel, etc., you used to be able to set the computer’s calendar and/or clock to an earlier time, create/modify the document, save it, and that’s what would show up in Summary or Properties. That was years ago; not sure if it’s still possible.
The programs that initially create and tag the files with the created/modified data use the system clock. It would be easy enough to reset the system clock to a previous/later date and copy the data from the original document to a document created with a modified system clock. Possibly tedious. I haven’t had reason to search out if there are any apps that would allow one to modify that data w/o going through a process like that though. If you just copy a document on the hard drive, it show the original data. I haven’t played to see if copying it to an external drive might provide new data and also remove/modify the version history.
it can be changed to show any modification timestamp even with a simple “touch” command. That being said, there are ways to reveal the modifications (that would also show some intent depending on which side of this you argue). Forensics evaluation could reveal the modifications. Another (and even simpler way) is if you can get copies of backup media and especially detailed logs from the backup software. The logs will show the previous timestamps of the files that would show something different than what they provide. The backup media will also show a timestamp of the file before it was changed. The timestamp of the file on backup media cannot be very easily modified (depending on the backup method and software used).
Timestamps on a computer can be modified using the command line “touch” command.
Such a vague question... It needs to be narrowed down to type of computer, software, etc.
I have a website running content management software. It runs on the Apache operating system the most free servers use.
There is a daily log file on that the apache system uses. It logs all changes to the system made by the users.
With a hex editor, you can compare file contents.
http://www.flexhex.com/docs/howtos/file-comparison.phtml
Not sure how that matters unless you have access to those archives. Regardless, I could simply say “I have no idea how they all have copies of a file other than this one. This is the file I manage.”
So, could this work for two versions of a website page that should correspond to one date? Could I compare a WB machine website page from Jan 2011 with a likely altered page purportedly from Jan 2011 that was used to show something else?
Answer is yes. BUT if it got on the net very hard to wipe it all. If it was on a local network then a competent IT guy could do it. Like others said several locations for dates, time etc. If there are images involved you need an expert to trace them.
I’m no expert, but it looks to me like it could.
As someone else said (I think), you would only want to examine copies of those files, since accessing or opening the original document could change the content. Sounds like a forensics expert is needed, but what you are looking to accomplish certainly seems doable.
I don’t know how those way back files are generated, but it seems like there should be a way to determine exactly when they were archived.
Disclaimer: Opinions posted on Free Republic are those of the individual posters and do not necessarily represent the opinion of Free Republic or its management. All materials posted herein are protected by copyright law and the exemption for fair use of copyrighted works.