[OT] How to tell if a file was copied?

Discussion in 'Computer Support' started by Jock Strap, Dec 22, 2004.

  1. Jock Strap

    Jock Strap Guest

    Jock Strap, Dec 22, 2004
    #1
    1. Advertising

  2. Jock Strap

    Dan DiNicolo Guest

    I'm not sure where you read that it was impossible to determine if a file
    was copied. That's simply not true. File systems store "last access"
    information. Just because you can't usually "see" it, doesn't mean it isn't
    there.

    A little reading:

    http://www.febooti.com/products/filetweak/online-help/file-last-accessed-date.html

    Dan
    --
    Dan DiNicolo
    MCSE, CCNP, CCDA
    http://www.2000trainers.com



    "Jock Strap" <> wrote in message
    news:...
    > Not exactly on-topic here, but I'm curious -- according to...
    >
    > http://news.com.com/id theft fears linger after laptop returned/2100-1029_3-5501200.html?tag=st_lh
    >
    > ...it says "the laptop is now in the hands of a forensics expert
    > who will try to determine whether or not the database was accessed
    > or copied".
    >
    > How is it possible to tell if a file was copied? It's impossible!
    >
    >
     
    Dan DiNicolo, Dec 22, 2004
    #2
    1. Advertising

  3. Jock Strap

    SgtMinor Guest

    Dan DiNicolo wrote:

    > I'm not sure where you read that it was impossible to determine if a file
    > was copied. That's simply not true. File systems store "last access"
    > information. Just because you can't usually "see" it, doesn't mean it isn't
    > there.
    >
    > A little reading:
    >
    > http://www.febooti.com/products/filetweak/online-help/file-last-accessed-date.html
    >
    > Dan


    The OP asked and stated: "How is it possible to tell if a file was
    copied? It's impossible!" Neither your reply nor the article you cited
    answered that.
     
    SgtMinor, Dec 22, 2004
    #3
  4. Jock Strap

    Dan DiNicolo Guest

    My apologies. The question sounded rhetorical to me. I provided a link that
    explained the fact that this information is saved. Programs like the one
    shown, as well as others like DirectoryOpus, ExplorerPlus, etc, will show
    the date the file was last accessed.

    Dan
    --
    Dan DiNicolo
    MCSE, CCNP, CCDA
    http://www.2000trainers.com


    "SgtMinor" <> wrote in message
    news:...
    > Dan DiNicolo wrote:
    >
    >> I'm not sure where you read that it was impossible to determine if a file
    >> was copied. That's simply not true. File systems store "last access"
    >> information. Just because you can't usually "see" it, doesn't mean it
    >> isn't there.
    >>
    >> A little reading:
    >>
    >> http://www.febooti.com/products/filetweak/online-help/file-last-accessed-date.html
    >>
    >> Dan

    >
    > The OP asked and stated: "How is it possible to tell if a file was copied?
    > It's impossible!" Neither your reply nor the article you cited answered
    > that.
     
    Dan DiNicolo, Dec 22, 2004
    #4
  5. Jock Strap

    Jock Strap Guest

    Dan DiNicolo wrote:

    > I'm not sure where you read that it was impossible to determine if a
    > file was copied. That's simply not true. File systems store "last
    > access" information. Just because you can't usually "see" it, doesn't
    > mean it isn't there.
    >
    > A little reading:
    >
    > http://www.febooti.com/products/filetweak/online-help/file-last-accessed-date.html


    Yes, selecting a file will modify its "Last Accessed" time stamp.
    How does that prove the file was copied anywhere? It doesn't.
     
    Jock Strap, Dec 22, 2004
    #5
  6. Jock Strap

    Guest

    On Wed, 22 Dec 2004 17:31:11 -0500, "Dan DiNicolo" <> wrote:

    |> I'm not sure where you read that it was impossible to determine if a file
    |> was copied. That's simply not true. File systems store "last access"
    |> information. Just because you can't usually "see" it, doesn't mean it isn't
    |> there.
    |>
    |> A little reading:
    |>
    |> http://www.febooti.com/products/filetweak/online-help/file-last-accessed-date.html
    |>

    Wow! I didn't know that, my computer really can nark me out.

    Open an explorer window
    right click on Name in right pane (any header)
    a list will pop up, select -More...-
    Then select -Date accessed-

    Now the date and time a file was last used is shown.

    This show'd the last time my text files were used but not Jpgs view'd,
    at least something is left private :)


    --
     
    , Dec 23, 2004
    #6
  7. Jock Strap

    Jock Strap Guest

    wrote:

    > This show'd the last time my text files were used but not Jpgs view'd,
    > at least something is left private :)


    It's not private at all -- JPGs still show the last accessed date. :)
    Have a look at their file properties (right-click the file, Properties).
     
    Jock Strap, Dec 23, 2004
    #7
  8. On Thu, 23 Dec 2004 10:45:49 +1100, "Jock Strap" <>
    wrote:

    >Dan DiNicolo wrote:
    >
    >> I'm not sure where you read that it was impossible to determine if a
    >> file was copied. That's simply not true. File systems store "last
    >> access" information. Just because you can't usually "see" it, doesn't
    >> mean it isn't there.
    >>
    >> A little reading:
    >>
    >> http://www.febooti.com/products/filetweak/online-help/file-last-accessed-date.html

    >
    >Yes, selecting a file will modify its "Last Accessed" time stamp.
    >How does that prove the file was copied anywhere? It doesn't.


    Using windows and right clicking and selecting properties resets the
    last date accessed to current date/time!! How stupid!!!.

    In command prompt window use:-

    dir /ta

    and it will show last date accessed and it will NOT change the last
    date/time accessed.



    --
    The Aussie Bomber
    Carn The Dons!!
     
    Aussie Bomber, Dec 23, 2004
    #8
  9. Jock Strap

    Richard Guest

    Jock Strap wrote:

    > Not exactly on-topic here, but I'm curious -- according to...


    > http://news.com.com/id theft fears linger after laptop returned/2100-1029_
    > 3-5501200.html?tag=st_lh


    > ...it says "the laptop is now in the hands of a forensics expert
    > who will try to determine whether or not the database was accessed
    > or copied".


    > How is it possible to tell if a file was copied? It's impossible!


    That's one of those things they want you to think about.
    No one can probe into your machine and tell you when a file was copied.
    Aceessed yes. But by whom and for what purpose?

    That's like during WWII they went around cities with trucks equipped with
    radio detection equipment telling people that if they had their receiving
    radio turned on, they would get a knock on the door.
    Bullshit. Receivers don't give out radio waves.

    Much like the so called radar detector detectors.
    Yeah they work. But only within a few feet.
    Then if only the thing is plugged in.

    Given enough time, they'll produce the evidence even if they have to create
    it.

    Problem is, making it stick against any one individual.
     
    Richard, Dec 23, 2004
    #9
  10. Jock Strap

    Richard Guest

    Dan DiNicolo wrote:

    > My apologies. The question sounded rhetorical to me. I provided a link
    > that explained the fact that this information is saved. Programs like the
    > one shown, as well as others like DirectoryOpus, ExplorerPlus, etc, will
    > show the date the file was last accessed.


    But that is all it show.
    As that's inherit in windows file directory system.
     
    Richard, Dec 23, 2004
    #10
  11. Jock Strap

    Richard Guest

    Dan DiNicolo wrote:

    > My apologies. The question sounded rhetorical to me. I provided a link
    > that explained the fact that this information is saved. Programs like the
    > one shown, as well as others like DirectoryOpus, ExplorerPlus, etc, will
    > show the date the file was last accessed.


    <quote>
    Any viewing, copying or moving of the documents, images and other files
    automatically alters last accessed date stamp of the file. However in some
    cases it might be essential to revert files last accessed date back to
    particular one (e.g. for sorting, recording, logging or other purposes).
    </quote>

    Copying accesses the file, thus the time stamp is changed.
     
    Richard, Dec 23, 2004
    #11
  12. Jock Strap

    Jim Byrd Guest

    Hi Richard - That's not entirely correct. AM receivers - particularly the
    tube types used in that era - contain what is called a local oscillator
    which is used to generate an offset radio frequency which is used to
    heterodyne or "beat" with the incoming radio signal at a particular
    frequency in order to "translate" it to an constant Intermediate Frequency
    or IF (455 kHz for AM, IIRC) which could then be easily amplified in
    fixed-tuned circuits. These local oscillators were, in effect, very low
    power RF generators which were readily detectable from the street. As a
    prank, as kids we often would tune one radio up and down in order to
    generate interference (a "squeal") in someone else's next door using that
    characteristic. :) The Germans during WWII used this same characteristic
    to detect clandestine receivers listening to the BBC in occupied France.

    --
    Please respond in the same thread.
    Regards, Jim Byrd, MS-MVP


    > That's like during WWII they went around cities with trucks equipped
    > with radio detection equipment telling people that if they had their
    > receiving radio turned on, they would get a knock on the door.
    > Bullshit. Receivers don't give out radio waves.
     
    Jim Byrd, Dec 23, 2004
    #12
  13. Jock Strap

    Guest

    On Thu, 23 Dec 2004 09:18:01 +1100, "Jock Strap" <> wrote:

    |> Not exactly on-topic here, but I'm curious -- according to...
    |>
    |> http://news.com.com/id theft fears linger after laptop returned/2100-1029_3-5501200.html?tag=st_lh
    |>
    |> ...it says "the laptop is now in the hands of a forensics expert
    |> who will try to determine whether or not the database was accessed
    |> or copied".
    |>
    |> How is it possible to tell if a file was copied? It's impossible!
    |>

    It's possible, I was curious myself and ran a test.

    In explorer I went to a rarely used directory and set it to display the
    files date accessed, hit F5 to refresh and the accessed dates on all
    files were 10-17-03.

    I open'd a dos window and from the root (so as not to enter the
    directory) copied all the files to another location.

    Back in explorer I hit F5 and all the dates were now 12-22-04.

    Now back in dos if you run - Dir /s /ta - you can get a listing of that
    partition's files listed by their access dates, saved as a text file you
    could search for certain dates.

    My next project is to see how I can globally reset the accessed dates on
    all files (It's a security thing)


    --
     
    , Dec 23, 2004
    #13
  14. Jock Strap

    trout Guest

    Jock Strap wrote:

    > wrote:
    >
    >> This show'd the last time my text files were used but not Jpgs
    >> view'd, at least something is left private :)

    >
    > It's not private at all -- JPGs still show the last accessed date. :)
    > Have a look at their file properties (right-click the file,
    > Properties).


    Yes, but there are programs, even for Dumb Guys, that can alter
    that, as well.
    For example, "Properties Plus" (free/abandonware)
    http://www.ne.jp/asahi/cool/kish/pplusmain.htm
    allows you to change the time stamps (created/accessed) of any file with
    a right-click.
    --
    "If it can be done, *someone's* probably written a program to do it more
    easily."
     
    trout, Dec 23, 2004
    #14
  15. Jock Strap

    Guest

    On Wed, 22 Dec 2004 23:18:31 -0800, "trout" <> wrote:

    |> Jock Strap wrote:
    |>
    |> > wrote:
    |> >
    |> >> This show'd the last time my text files were used but not Jpgs
    |> >> view'd, at least something is left private :)
    |> >
    |> > It's not private at all -- JPGs still show the last accessed date. :)
    |> > Have a look at their file properties (right-click the file,
    |> > Properties).
    |>
    |> Yes, but there are programs, even for Dumb Guys, that can alter
    |> that, as well.
    |> For example, "Properties Plus" (free/abandonware)
    |> http://www.ne.jp/asahi/cool/kish/pplusmain.htm
    |> allows you to change the time stamps (created/accessed) of any file with
    |> a right-click.

    Thanks for the link, it works well, on whole partitions as well as
    individual files.


    --
     
    , Dec 23, 2004
    #15
  16. Jock Strap

    trout Guest

    wrote:

    [snip]

    > On Wed, 22 Dec 2004 23:18:31 -0800, "trout" <> wrote:


    >> For example, "Properties Plus" (free/abandonware)
    >> http://www.ne.jp/asahi/cool/kish/pplusmain.htm
    >> allows you to change the time stamps (created/accessed) of any file
    >> with a right-click.

    >
    > Thanks for the link, it works well, on whole partitions as well as
    > individual files.


    I'm glad you noticed. It was actually another post of yours in the
    thread that brought this to mind.
    --
    "I just like finding these things. Next-to-pointless stuff *can* be
    fun."
     
    trout, Dec 23, 2004
    #16
  17. Jock Strap

    Jock Strap Guest

    Aussie Bomber wrote:

    >> Yes, selecting a file will modify its "Last Accessed" time stamp.
    >> How does that prove the file was copied anywhere? It doesn't.

    >
    > Using windows and right clicking and selecting properties resets the
    > last date accessed to current date/time!! How stupid!!!.


    It even works if the file is set to "Read Only". :)
     
    Jock Strap, Dec 23, 2004
    #17
  18. Jock Strap

    Jock Strap Guest

    Richard wrote:

    > Copying accesses the file, thus the time stamp is changed.


    You're missing one vital point. Yes, the above statement is true.
    But the time stamp can be changed by many other means. One can't
    PROVE the file was actually copied, as opposed to just viewing it.
    That's why it's impossible to tell if a file was actually copied.
     
    Jock Strap, Dec 23, 2004
    #18
  19. Jock Strap

    Jock Strap Guest

    wrote:

    > Back in explorer I hit F5 and all the dates were now 12-22-04.


    Doesn't prove they were copied -- only accessed at that time.
     
    Jock Strap, Dec 23, 2004
    #19
  20. Jock Strap

    Guest

    On Thu, 23 Dec 2004 22:50:48 +1100, "Jock Strap" <> wrote:

    |> wrote:
    |>
    |> > Back in explorer I hit F5 and all the dates were now 12-22-04.
    |>
    |> Doesn't prove they were copied -- only accessed at that time.
    |>

    Oh ye non believer, and why I
    |> hit F5 to refresh and the accessed dates on all
    |> files were 10-17-03.

    I refresh'd first to make sure that wasn't what caused it date change.

    I got the same results when I would highlight a group of files then drag
    and drop (copy) them in a different directory; I didn't think that
    decent test or prove anything and why I went into dos to copy them.

    Trying it yourself is the best test.

    FWIW Same thing happens under Win98, you just can't tell until your in
    XP to use the "accessed date" option.

    Also a read only file won't change it's accessed date, but one can't
    have a lot of read only files as it prevents defrag from doing it's job.


    --
     
    , Dec 23, 2004
    #20
    1. Advertising

Want to reply to this thread or ask your own question?

It takes just 2 minutes to sign up (and it's free!). Just click the sign up button to choose a username and then you can ask your own questions on the forum.
Similar Threads
  1. Jeff Ingram
    Replies:
    1
    Views:
    505
    KungFusion
    Jul 15, 2004
  2. Jim Swan

    How can you tell if a copied DVD is Pal or NTSC?

    Jim Swan, Sep 25, 2004, in forum: Computer Support
    Replies:
    2
    Views:
    15,684
    Timberwolf
    Sep 25, 2004
  3. Replies:
    4
    Views:
    602
  4. Replies:
    4
    Views:
    1,141
  5. Mike
    Replies:
    7
    Views:
    1,447
Loading...

Share This Page