Complience problem: file dates

Discussion in 'Windows 64bit' started by =?Utf-8?B?ZGF2aWQgc291c3Nhbg==?=, Apr 20, 2007.

  1. I have a compliance problem and I need to know and be able to explain to
    legal team the meaning of a file's Date Created, Date Modified, Date Accessed
    properties: what they are, when they are set and under what conditions they
    are changed/updated.

    It's funny but untill I had to explain this I always just took them for
    granted. Now I realised that I am actually unsure what and when date accessed
    is changed.
     
    =?Utf-8?B?ZGF2aWQgc291c3Nhbg==?=, Apr 20, 2007
    #1
    1. Advertising

  2. =?Utf-8?B?ZGF2aWQgc291c3Nhbg==?=

    David Craig Guest

    If you do not have any specialized security software on the system, you can
    take those values to mean whatever the last person who set them or caused
    them to be set meant for them to mean. They can be set, reset, and altered
    by any file owner or someone who has the usual access rights to the files.

    "david soussan" <david > wrote in message
    news:...
    >I have a compliance problem and I need to know and be able to explain to
    > legal team the meaning of a file's Date Created, Date Modified, Date
    > Accessed
    > properties: what they are, when they are set and under what conditions
    > they
    > are changed/updated.
    >
    > It's funny but untill I had to explain this I always just took them for
    > granted. Now I realised that I am actually unsure what and when date
    > accessed
    > is changed.
     
    David Craig, Apr 20, 2007
    #2
    1. Advertising

  3. Sorry, but I don't think you understand me.

    The last person who caused these values to be set would be an ordinary user
    who did not set them, they were set for the user by the operating system or
    application being used. The user therefore had no intention for them to mean
    anything, the normal user does not even know that they exist let alone what
    they mean.

    I am charged with defining under what circumstances date modified and date
    accessed would be undated. Would a user have to actively open and view the
    file with a relavent application, or would doing a backup also update the
    date accessed. Would attempting to open a file for which the user had
    insuffiecient access permissions also update that property?

    I do see that just right clicking on the file and viewing its properties
    changes the date accessed to the current date and time, which in itself
    creates problems for auditing and compliance.

    I have searched knowledge base etc and cannot find any definition for these
    basic file properties, what they mean in general, when they are set and when
    they are updated. This is what I need to know: what the operating systems
    does, not what a programmer might choose to do but what happens when a user
    goes about his normal business using eg Word.

    "David Craig" wrote:

    > If you do not have any specialized security software on the system, you can
    > take those values to mean whatever the last person who set them or caused
    > them to be set meant for them to mean. They can be set, reset, and altered
    > by any file owner or someone who has the usual access rights to the files.
    >
    > "david soussan" <david > wrote in message
    > news:...
    > >I have a compliance problem and I need to know and be able to explain to
    > > legal team the meaning of a file's Date Created, Date Modified, Date
    > > Accessed
    > > properties: what they are, when they are set and under what conditions
    > > they
    > > are changed/updated.
    > >
    > > It's funny but untill I had to explain this I always just took them for
    > > granted. Now I realised that I am actually unsure what and when date
    > > accessed
    > > is changed.

    >
    >
    >
     
    =?Utf-8?B?ZGF2aWQgc291c3Nhbg==?=, Apr 20, 2007
    #3
  4. =?Utf-8?B?ZGF2aWQgc291c3Nhbg==?=

    David Craig Guest

    The last accessed info can be changed by many things as you have discovered.
    Update of that field can be inhibited if desired. The sources are available
    for the FAT file system so you can answer your own questions about those
    dates/times, but there are only articles on the rules for NTFS.

    "david soussan" <> wrote in message
    news:...
    > Sorry, but I don't think you understand me.
    >
    > The last person who caused these values to be set would be an ordinary
    > user
    > who did not set them, they were set for the user by the operating system
    > or
    > application being used. The user therefore had no intention for them to
    > mean
    > anything, the normal user does not even know that they exist let alone
    > what
    > they mean.
    >
    > I am charged with defining under what circumstances date modified and date
    > accessed would be undated. Would a user have to actively open and view the
    > file with a relavent application, or would doing a backup also update the
    > date accessed. Would attempting to open a file for which the user had
    > insuffiecient access permissions also update that property?
    >
    > I do see that just right clicking on the file and viewing its properties
    > changes the date accessed to the current date and time, which in itself
    > creates problems for auditing and compliance.
    >
    > I have searched knowledge base etc and cannot find any definition for
    > these
    > basic file properties, what they mean in general, when they are set and
    > when
    > they are updated. This is what I need to know: what the operating systems
    > does, not what a programmer might choose to do but what happens when a
    > user
    > goes about his normal business using eg Word.
    >
    > "David Craig" wrote:
    >
    >> If you do not have any specialized security software on the system, you
    >> can
    >> take those values to mean whatever the last person who set them or caused
    >> them to be set meant for them to mean. They can be set, reset, and
    >> altered
    >> by any file owner or someone who has the usual access rights to the
    >> files.
    >>
    >> "david soussan" <david > wrote in
    >> message
    >> news:...
    >> >I have a compliance problem and I need to know and be able to explain to
    >> > legal team the meaning of a file's Date Created, Date Modified, Date
    >> > Accessed
    >> > properties: what they are, when they are set and under what conditions
    >> > they
    >> > are changed/updated.
    >> >
    >> > It's funny but untill I had to explain this I always just took them for
    >> > granted. Now I realised that I am actually unsure what and when date
    >> > accessed
    >> > is changed.

    >>
    >>
    >>
     
    David Craig, Apr 20, 2007
    #4
  5. =?Utf-8?B?ZGF2aWQgc291c3Nhbg==?=

    John Barnes Guest

    The backup program changes the archived flag and also therefore the accessed
    date.

    "david soussan" <> wrote in message
    news:...
    > Sorry, but I don't think you understand me.
    >
    > The last person who caused these values to be set would be an ordinary
    > user
    > who did not set them, they were set for the user by the operating system
    > or
    > application being used. The user therefore had no intention for them to
    > mean
    > anything, the normal user does not even know that they exist let alone
    > what
    > they mean.
    >
    > I am charged with defining under what circumstances date modified and date
    > accessed would be undated. Would a user have to actively open and view the
    > file with a relavent application, or would doing a backup also update the
    > date accessed. Would attempting to open a file for which the user had
    > insuffiecient access permissions also update that property?
    >
    > I do see that just right clicking on the file and viewing its properties
    > changes the date accessed to the current date and time, which in itself
    > creates problems for auditing and compliance.
    >
    > I have searched knowledge base etc and cannot find any definition for
    > these
    > basic file properties, what they mean in general, when they are set and
    > when
    > they are updated. This is what I need to know: what the operating systems
    > does, not what a programmer might choose to do but what happens when a
    > user
    > goes about his normal business using eg Word.
    >
    > "David Craig" wrote:
    >
    >> If you do not have any specialized security software on the system, you
    >> can
    >> take those values to mean whatever the last person who set them or caused
    >> them to be set meant for them to mean. They can be set, reset, and
    >> altered
    >> by any file owner or someone who has the usual access rights to the
    >> files.
    >>
    >> "david soussan" <david > wrote in
    >> message
    >> news:...
    >> >I have a compliance problem and I need to know and be able to explain to
    >> > legal team the meaning of a file's Date Created, Date Modified, Date
    >> > Accessed
    >> > properties: what they are, when they are set and under what conditions
    >> > they
    >> > are changed/updated.
    >> >
    >> > It's funny but untill I had to explain this I always just took them for
    >> > granted. Now I realised that I am actually unsure what and when date
    >> > accessed
    >> > is changed.

    >>
    >>
    >>
     
    John Barnes, Apr 21, 2007
    #5
  6. This is a convoluted concept, I am also not quite sure what these people are
    really asking of you. If the question is - "Can the OS be expected to make
    random changes to the 'Date-of-File' structure?", changes that are out of
    your control, then the answer surely has to be NO. The OS is 'Event Driven'
    and responds only in a way that would require access. A running Back Up
    script, as an example, where the system is checking the dates would not make
    the dates change, as I understand. A script running with sufficient
    authority that specifically do make an effort of checking the dates on it's
    own, might do that, however.

    Anybody who can see the file and who can issue commands to the OS can also
    change the date (or make the date change!) The only control is to limit who
    can see the file, you'll have to use access-control and double-check with
    logfiles to verify that any date changes are making sense.

    If this is a kind of 'Patent' issue, there are Companies that Registers
    Software in a way that protects and secures the original developer.

    For a definition on the OS's use of the 'File Date' structure, You would
    probably find better help in a developer forum on MSDN - or ask Windows
    Support!

    On the other hand, this being a File System issue - Darrell might spot this.
    .. ?


    Tony. . .


    "david soussan" <> wrote in message
    news:...
    > Sorry, but I don't think you understand me.
    >
    > The last person who caused these values to be set would be an ordinary

    user
    > who did not set them, they were set for the user by the operating system

    or
    > application being used. The user therefore had no intention for them to

    mean
    > anything, the normal user does not even know that they exist let alone

    what
    > they mean.
    >
    > I am charged with defining under what circumstances date modified and date
    > accessed would be undated. Would a user have to actively open and view the
    > file with a relavent application, or would doing a backup also update the
    > date accessed. Would attempting to open a file for which the user had
    > insuffiecient access permissions also update that property?
    >
    > I do see that just right clicking on the file and viewing its properties
    > changes the date accessed to the current date and time, which in itself
    > creates problems for auditing and compliance.
    >
    > I have searched knowledge base etc and cannot find any definition for

    these
    > basic file properties, what they mean in general, when they are set and

    when
    > they are updated. This is what I need to know: what the operating systems
    > does, not what a programmer might choose to do but what happens when a

    user
    > goes about his normal business using eg Word.
    >
    > "David Craig" wrote:
    >
    > > If you do not have any specialized security software on the system, you

    can
    > > take those values to mean whatever the last person who set them or

    caused
    > > them to be set meant for them to mean. They can be set, reset, and

    altered
    > > by any file owner or someone who has the usual access rights to the

    files.
    > >
    > > "david soussan" <david > wrote in

    message
    > > news:...
    > > >I have a compliance problem and I need to know and be able to explain

    to
    > > > legal team the meaning of a file's Date Created, Date Modified, Date
    > > > Accessed
    > > > properties: what they are, when they are set and under what conditions
    > > > they
    > > > are changed/updated.
    > > >
    > > > It's funny but untill I had to explain this I always just took them

    for
    > > > granted. Now I realised that I am actually unsure what and when date
    > > > accessed
    > > > is changed.

    > >
    > >
    > >
     
    Tony Sperling, Apr 22, 2007
    #6
    1. Advertising

Want to reply to this thread or ask your own question?

It takes just 2 minutes to sign up (and it's free!). Just click the sign up button to choose a username and then you can ask your own questions on the forum.
Similar Threads
  1. nicearoni

    Thunderbird 1969 email dates?

    nicearoni, Jul 29, 2005, in forum: Firefox
    Replies:
    2
    Views:
    976
    Ralph Fox
    Jul 29, 2005
  2. John
    Replies:
    3
    Views:
    518
    Jaime
    Oct 17, 2003
  3. E Jones

    File Dates on Kodak Pictures

    E Jones, Sep 25, 2003, in forum: Digital Photography
    Replies:
    3
    Views:
    621
    R.S. [Bob] Heuman
    Sep 26, 2003
  4. Lawrence D'Oliveiro

    Mac file dates & AppleShare

    Lawrence D'Oliveiro, Feb 10, 2008, in forum: NZ Computing
    Replies:
    20
    Views:
    1,031
    Nicolaas Hawkins
    Feb 12, 2008
  5. Lawrence D'Oliveiro

    Fixing file mod dates

    Lawrence D'Oliveiro, Oct 27, 2008, in forum: NZ Computing
    Replies:
    9
    Views:
    448
    Lawrence D'Oliveiro
    Oct 28, 2008
Loading...

Share This Page