File metadata and timestamps
Metadata describes a system’s records, not a complete human history.
The idea
File metadata can include names, sizes, ownership, permissions, and timestamps. Timestamp meanings and update behavior vary by filesystem, operating system, and application. Copies, extraction, clock problems, and deliberate changes can affect values. Preserve original fields and distinguish modification, access, and metadata-change concepts where applicable. A timeline should combine multiple sources rather than assuming one timestamp identifies a person’s action.
In practice
A copied document retains one timestamp but receives another on the destination filesystem. The investigator records both contexts before reconstructing events.
A common misunderstanding
A timestamp does not by itself prove who edited a file or whether the content was opened.
Check your understanding
What should you check before interpreting a time field?
Think it through: Its documented meaning, system clock context, and how the file was acquired or moved.
A timestamp describes a system-defined event
Creation, modification, access, and metadata-change fields have meanings defined by the filesystem and application. Copying, extracting an archive, synchronization, and backup restoration can alter them in different ways. A creation time may describe creation of this copy rather than authorship of the original content. Learn the semantics of the actual platform before interpreting a field.
Timestamp precision and update behavior also vary. Some access-time updates may be disabled, delayed, or coarsely recorded. Timezones and clock errors can affect comparison. A neat chronological table does not make every timestamp equally reliable, and an unexpected value is a lead rather than automatic proof of deliberate tampering.
A fictional copied assessment
An academy finds a document with a recent filesystem creation time but older internal application properties. The analyst considers copying and export as possible explanations. Additional evidence such as download records, archive contents, or application history may help reconstruct the route. The discrepancy alone does not establish who authored the document or whether its content changed.
Preserve original metadata during acquisition where feasible and document collection-induced changes. Reports should identify the source of each timestamp rather than simply label a column date. This lets reviewers understand why two records might disagree without assuming one is necessarily false.
Compare a controlled copy
Create a harmless text file in a training environment, record its metadata, then copy it through an approved ordinary workflow. Compare the resulting fields and explain which changed. Repeat only where safe and relevant. The exercise demonstrates why metadata needs context before it can support a claim about a person's actions or the original history of a file.
Keep exploring
References & further reading
Original explanations, with primary references for deeper study.
NIST: Integrating Forensic Techniques into Incident Response