[sbnsd]

the last access date and time on all 101 would change to the current time, making it look like I looked at the porno picture too.

It doesn't seem like a very reliable way to determine when something was REALLY accessed last. The second you try looking at the properties, it timestamps it. I guess I need ENCASE; that was the name of the program, right? Or was it ENDCASE?

[John Jamieson]

I suspect all the "spy software", reads the last access date, stores it, opens the file, displays it, and then forces the last access date back to it's original value. Erasing all evidence that it was used.

[John Jamieson]

The World's Leading Solution for Computer Investigations and Forensics


Award winning and validated by the courts, EnCase allows law enforcement and IT professionals to conduct a powerful, yet completely non-invasive computer forensic investigation. EnCase features a intuitive GUI that enables examiners to easily manage large volumes of computer evidence and view all relevant files, including "deleted" files, file slack and unallocated space. The solution effectively automates core investigative procedures, replacing archaic, time-consuming and cost-prohibitive processes and tools.

The integrated functionality of EnCase allows the examiner to perform all functions of the computer forensic investigation process. EnCase's Escript, is a powerful macro-programming language and API that allows investigators to build customized and reusable forensic scripts.