When situation causes Firefox cache file to have Windows modified date more recent than the access date?
I'm reviewing a report from a forensic examination of a hard drive from a Windows machine. In that report are Firefox 3.x cache files where the Windows modified date is more recent than both the Windows created date and the Windows accessed date, with the latter two dates the same. For instance, the modified date might be March 23, 2011 at 10:30 am, and the created and accessed dates might be March 17 at 9:50 pm. What actions, by Firefox, a user, or some other program (other than a date-modification tool) would cause this state of affairs? I'm generally familiar with these dates and under what conditions they change, but have found no doc explaining this particular situation...
I'm reviewing a report from a forensic examination of a hard drive from a Windows machine. In that report are Firefox 3.x cache files where the Windows modified date is more recent than both the Windows created date and the Windows accessed date, with the latter two dates the same. For instance, the modified date might be March 23, 2011 at 10:30 am, and the created and accessed dates might be March 17 at 9:50 pm. What actions, by Firefox, a user, or some other program (other than a date-modification tool) would cause this state of affairs? I'm generally familiar with these dates and under what conditions they change, but have found no doc explaining this particular situation...
Alle svar (1)
In your example,
- the site was originally visited on March 17 at 9:50 pm and the cache entry was created; at that time all three dates should be the same
- the user visited the site again and the information in that cache file was modified on that second visit, March 23, 2011 at 10:30 am
- my experience makes me agree with the first answer in the first link below that accessed timestamp on Windows system is not always accurate; AND accessed timestamp differs for files and folders as defined in the third link below
- See:
Ændret af Helper7677 den