Trik: Preserve Those Dates/Times

It is pretty easy to change the timestamps on electronic documents; simply drag or copy one file to another location on your computer and presto, the file has a new created date/time. Modify that same file and it will have a new modified date/time. When dealing with electronic evidence it is important NOT to do just that, but more often than not it happens. To prevent future disaster the next time you are copying evidence you or your client can use a free and easy-to-use tool; Robocopy.
For a list of commands you can use with Robocopy, click here

Robocopy, by default, will preserve the created and modified dates/times of every file. It has some other useful commands like copying or excluding selected file types(very useful for eDiscovery).

If you aren’t comfortable with writing in command line, then you could use WinRAR to compress the evidence into one file, but be sure to set the “preserve dates/times” option before compressing. WinZip is not suggested here because it does not preserve both created and modified dates/times.

There are many copy utilities out there that will accomplish the same tasks, some free, some not-so-free, but these two solutions will do a good job at preserving important meta-data and keeping your evidence spoil-free.

Posted by Logik Systems