# time clues in data source

**URL:** <https://sleuthkit.discourse.group/t/time-clues-in-data-source/5389>\
**Category:** Autopsy Help\
**Created:** [March 10, 2025, 12:37pm UTC](https://sleuthkit.discourse.group/t/time-clues-in-data-source/5389 "2025-03-10T12:37:36Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![Carla\_Vieira](https://yyz2.discourse-cdn.com/free1/user_avatar/sleuthkit.discourse.group/carla_vieira/32/2151_2.png) [@Carla\_Vieira](https://sleuthkit.discourse.group/u/Carla_Vieira)\
**Post date:** [March 10, 2025, 12:37pm UTC](https://sleuthkit.discourse.group/t/time-clues-in-data-source/5389/1 "2025-03-10T12:37:36Z")

</div>

Hi everyone!

I am working (studying) on a case that has some puzzling dates. The disk image is from a USB drive date 2017. The files of interest were modified in 2002 (I would say written and saved then) and created in 2005 (saved onto USB). But it is a murder case so the suspect would have every reason to tamper the files. Why would he backdate it to 12 years prior to the murder? Is there a nuance in the dates definition that i am missing? TIA