I’m pretty new to Autopsy so I’m going through a bit of confusion on something I’m doing at the moment. I have to record these creation dates as accurately as possible and a bit confused by the files shown below.
This shows under the results tab in the metadata section of extracted content, this creation date says 2017 for a file I’m looking at.
The dates you use would depend on what question you are trying to answer. The File Metadata are dates based on when the actual file was manipulated in the file system. The Results are based on some metadata within the file, since you did not provide the file type then it is hard to determine what the metadata is based on. My suggestion is to learn what the metadata means so that you can interpret that data and what the relationship may mean to the file system metadata for that file.
The file type was a word document placed on an SD card, essentially It’s some work based on a crime and I have to present the evidence. I guessed the metadata was altered but I was just wondering which of those two creation dates would be the most reliable?
I guess it would be easy enough to alter both though.
