Recently i noticed something in autopsy that when we export any content out of autopsy,lets say document, the timestamps of the particular document is getting changed to the present date of export of the investigator system?
For testing purposes, performed the same test with FTK and found that in that case the time stamps are same as the original timestamps of the evidence and not getting changed.
Can anyone suggest me a possibe reason for this?
The only reason is that Autopsy does not export orginal metadata timestamps.
So how can this be justified in court?