Autopsy file creation date confusion

Autopsy Help
#1

Hey guys!

I’m pretty new to Autopsy so I’m going through a bit of confusion on something I’m doing at the moment. I have to record these creation dates as accurately as possible and a bit confused by the files shown below.

This shows under the results tab in the metadata section of extracted content, this creation date says 2017 for a file I’m looking at.

806×224 14.5 KB

This shows file details under the metadata file tab which is the same file and shows a creation date.

871×206 14.5 KB

This is the same for most of the files i am looking at so just wondering which dates you would use?

Thanks for any help, much appreciated!

#2

The dates you use would depend on what question you are trying to answer. The File Metadata are dates based on when the actual file was manipulated in the file system. The Results are based on some metadata within the file, since you did not provide the file type then it is hard to determine what the metadata is based on. My suggestion is to learn what the metadata means so that you can interpret that data and what the relationship may mean to the file system metadata for that file.

#3

Hey, thanks for the reply!

The file type was a word document placed on an SD card, essentially It’s some work based on a crime and I have to present the evidence. I guessed the metadata was altered but I was just wondering which of those two creation dates would be the most reliable?

I guess it would be easy enough to alter both though.