# Change of metadata for exported content

**URL:** <https://sleuthkit.discourse.group/t/change-of-metadata-for-exported-content/3253>\
**Category:** Autopsy Help\
**Created:** [May 27, 2022, 1:00pm UTC](https://sleuthkit.discourse.group/t/change-of-metadata-for-exported-content/3253 "2022-05-27T13:00:12Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![DFA](https://avatars.discourse-cdn.com/v4/letter/d/74df32/32.png) [@DFA](https://sleuthkit.discourse.group/u/DFA)\
**Post date:** [May 27, 2022, 1:00pm UTC](https://sleuthkit.discourse.group/t/change-of-metadata-for-exported-content/3253/1 "2022-05-27T13:00:13Z")

</div>

Recently i noticed something in autopsy that when we export any content out of autopsy,lets say document, the timestamps of the particular document is getting changed to the present date of export of the investigator system?  
For testing purposes, performed the same test with FTK and found that in that case the time stamps are same as the original timestamps of the evidence and not getting changed.

---

<div class="post-metadata">

**Author:** ![DFA](https://avatars.discourse-cdn.com/v4/letter/d/74df32/32.png) [@DFA](https://sleuthkit.discourse.group/u/DFA)\
**Post date:** [May 28, 2022, 5:00am UTC](https://sleuthkit.discourse.group/t/change-of-metadata-for-exported-content/3253/2 "2022-05-28T05:00:14Z")

</div>

Can anyone suggest me a possibe reason for this?

---

<div class="post-metadata">

**Author:** ![grzesiug](https://avatars.discourse-cdn.com/v4/letter/g/839c29/32.png) [@grzesiug](https://sleuthkit.discourse.group/u/grzesiug)\
**Post date:** [May 29, 2022, 6:14pm UTC](https://sleuthkit.discourse.group/t/change-of-metadata-for-exported-content/3253/3 "2022-05-29T18:14:46Z")

</div>

The only reason is that Autopsy does not export orginal metadata timestamps.

---

<div class="post-metadata">

**Author:** ![DFA](https://avatars.discourse-cdn.com/v4/letter/d/74df32/32.png) [@DFA](https://sleuthkit.discourse.group/u/DFA)\
**Post date:** [May 30, 2022, 4:18am UTC](https://sleuthkit.discourse.group/t/change-of-metadata-for-exported-content/3253/4 "2022-05-30T04:18:20Z")

</div>

So how can this be justified in court?
