|
|
I have a compliance problem and I need to know and be able to explain to
legal team the meaning of a file's Date Created, Date Modified, Date Accessed
properties: what they are, when they are set and under what conditions they
are changed/updated.
It's funny but untill I had to explain this I always just took them for
granted. Now I realised that I am actually unsure what and when date accessed
is changed.
|
|
If you do not have any specialized security software on the system, you can
take those values to mean whatever the last person who set them or caused
them to be set meant for them to mean. They can be set, reset, and altered
by any file owner or someone who has the usual access rights to the files.
"david soussan" <david soussan[ at ]discussions.microsoft.com> wrote in message
news:0BA598C9-4E89-47E2-ADBE-F47D70EFBA31[ at ]microsoft.com...
[Quoted Text] >I have a compliance problem and I need to know and be able to explain to
> legal team the meaning of a file's Date Created, Date Modified, Date
> Accessed
> properties: what they are, when they are set and under what conditions
> they
> are changed/updated.
>
> It's funny but untill I had to explain this I always just took them for
> granted. Now I realised that I am actually unsure what and when date
> accessed
> is changed.
|
|
Sorry, but I don't think you understand me.
The last person who caused these values to be set would be an ordinary user
who did not set them, they were set for the user by the operating system or
application being used. The user therefore had no intention for them to mean
anything, the normal user does not even know that they exist let alone what
they mean.
I am charged with defining under what circumstances date modified and date
accessed would be undated. Would a user have to actively open and view the
file with a relavent application, or would doing a backup also update the
date accessed. Would attempting to open a file for which the user had
insuffiecient access permissions also update that property?
I do see that just right clicking on the file and viewing its properties
changes the date accessed to the current date and time, which in itself
creates problems for auditing and compliance.
I have searched knowledge base etc and cannot find any definition for these
basic file properties, what they mean in general, when they are set and when
they are updated. This is what I need to know: what the operating systems
does, not what a programmer might choose to do but what happens when a user
goes about his normal business using eg Word.
"David Craig" wrote:
[Quoted Text] > If you do not have any specialized security software on the system, you can
> take those values to mean whatever the last person who set them or caused
> them to be set meant for them to mean. They can be set, reset, and altered
> by any file owner or someone who has the usual access rights to the files.
>
> "david soussan" <david soussan[ at ]discussions.microsoft.com> wrote in message
> news:0BA598C9-4E89-47E2-ADBE-F47D70EFBA31[ at ]microsoft.com...
> >I have a compliance problem and I need to know and be able to explain to
> > legal team the meaning of a file's Date Created, Date Modified, Date
> > Accessed
> > properties: what they are, when they are set and under what conditions
> > they
> > are changed/updated.
> >
> > It's funny but untill I had to explain this I always just took them for
> > granted. Now I realised that I am actually unsure what and when date
> > accessed
> > is changed.
>
>
>
|
|
The last accessed info can be changed by many things as you have discovered.
Update of that field can be inhibited if desired. The sources are available
for the FAT file system so you can answer your own questions about those
dates/times, but there are only articles on the rules for NTFS.
"david soussan" <davidsoussan[ at ]discussions.microsoft.com> wrote in message
news:0C5547B0-D518-439A-BE17-BEBD31AE5571[ at ]microsoft.com...
[Quoted Text] > Sorry, but I don't think you understand me.
>
> The last person who caused these values to be set would be an ordinary
> user
> who did not set them, they were set for the user by the operating system
> or
> application being used. The user therefore had no intention for them to
> mean
> anything, the normal user does not even know that they exist let alone
> what
> they mean.
>
> I am charged with defining under what circumstances date modified and date
> accessed would be undated. Would a user have to actively open and view the
> file with a relavent application, or would doing a backup also update the
> date accessed. Would attempting to open a file for which the user had
> insuffiecient access permissions also update that property?
>
> I do see that just right clicking on the file and viewing its properties
> changes the date accessed to the current date and time, which in itself
> creates problems for auditing and compliance.
>
> I have searched knowledge base etc and cannot find any definition for
> these
> basic file properties, what they mean in general, when they are set and
> when
> they are updated. This is what I need to know: what the operating systems
> does, not what a programmer might choose to do but what happens when a
> user
> goes about his normal business using eg Word.
>
> "David Craig" wrote:
>
>> If you do not have any specialized security software on the system, you
>> can
>> take those values to mean whatever the last person who set them or caused
>> them to be set meant for them to mean. They can be set, reset, and
>> altered
>> by any file owner or someone who has the usual access rights to the
>> files.
>>
>> "david soussan" <david soussan[ at ]discussions.microsoft.com> wrote in
>> message
>> news:0BA598C9-4E89-47E2-ADBE-F47D70EFBA31[ at ]microsoft.com...
>> >I have a compliance problem and I need to know and be able to explain to
>> > legal team the meaning of a file's Date Created, Date Modified, Date
>> > Accessed
>> > properties: what they are, when they are set and under what conditions
>> > they
>> > are changed/updated.
>> >
>> > It's funny but untill I had to explain this I always just took them for
>> > granted. Now I realised that I am actually unsure what and when date
>> > accessed
>> > is changed.
>>
>>
>>
|
|
The backup program changes the archived flag and also therefore the accessed
date.
"david soussan" <davidsoussan[ at ]discussions.microsoft.com> wrote in message
news:0C5547B0-D518-439A-BE17-BEBD31AE5571[ at ]microsoft.com...
[Quoted Text] > Sorry, but I don't think you understand me.
>
> The last person who caused these values to be set would be an ordinary
> user
> who did not set them, they were set for the user by the operating system
> or
> application being used. The user therefore had no intention for them to
> mean
> anything, the normal user does not even know that they exist let alone
> what
> they mean.
>
> I am charged with defining under what circumstances date modified and date
> accessed would be undated. Would a user have to actively open and view the
> file with a relavent application, or would doing a backup also update the
> date accessed. Would attempting to open a file for which the user had
> insuffiecient access permissions also update that property?
>
> I do see that just right clicking on the file and viewing its properties
> changes the date accessed to the current date and time, which in itself
> creates problems for auditing and compliance.
>
> I have searched knowledge base etc and cannot find any definition for
> these
> basic file properties, what they mean in general, when they are set and
> when
> they are updated. This is what I need to know: what the operating systems
> does, not what a programmer might choose to do but what happens when a
> user
> goes about his normal business using eg Word.
>
> "David Craig" wrote:
>
>> If you do not have any specialized security software on the system, you
>> can
>> take those values to mean whatever the last person who set them or caused
>> them to be set meant for them to mean. They can be set, reset, and
>> altered
>> by any file owner or someone who has the usual access rights to the
>> files.
>>
>> "david soussan" <david soussan[ at ]discussions.microsoft.com> wrote in
>> message
>> news:0BA598C9-4E89-47E2-ADBE-F47D70EFBA31[ at ]microsoft.com...
>> >I have a compliance problem and I need to know and be able to explain to
>> > legal team the meaning of a file's Date Created, Date Modified, Date
>> > Accessed
>> > properties: what they are, when they are set and under what conditions
>> > they
>> > are changed/updated.
>> >
>> > It's funny but untill I had to explain this I always just took them for
>> > granted. Now I realised that I am actually unsure what and when date
>> > accessed
>> > is changed.
>>
>>
>>
|
|
This is a convoluted concept, I am also not quite sure what these people are
really asking of you. If the question is - "Can the OS be expected to make
random changes to the 'Date-of-File' structure?", changes that are out of
your control, then the answer surely has to be NO. The OS is 'Event Driven'
and responds only in a way that would require access. A running Back Up
script, as an example, where the system is checking the dates would not make
the dates change, as I understand. A script running with sufficient
authority that specifically do make an effort of checking the dates on it's
own, might do that, however.
Anybody who can see the file and who can issue commands to the OS can also
change the date (or make the date change!) The only control is to limit who
can see the file, you'll have to use access-control and double-check with
logfiles to verify that any date changes are making sense.
If this is a kind of 'Patent' issue, there are Companies that Registers
Software in a way that protects and secures the original developer.
For a definition on the OS's use of the 'File Date' structure, You would
probably find better help in a developer forum on MSDN - or ask Windows
Support!
On the other hand, this being a File System issue - Darrell might spot this.
.. ?
Tony. . .
"david soussan" <davidsoussan[ at ]discussions.microsoft.com> wrote in message
news:0C5547B0-D518-439A-BE17-BEBD31AE5571[ at ]microsoft.com...
[Quoted Text] > Sorry, but I don't think you understand me.
>
> The last person who caused these values to be set would be an ordinary
user
> who did not set them, they were set for the user by the operating system
or
> application being used. The user therefore had no intention for them to
mean
> anything, the normal user does not even know that they exist let alone
what
> they mean.
>
> I am charged with defining under what circumstances date modified and date
> accessed would be undated. Would a user have to actively open and view the
> file with a relavent application, or would doing a backup also update the
> date accessed. Would attempting to open a file for which the user had
> insuffiecient access permissions also update that property?
>
> I do see that just right clicking on the file and viewing its properties
> changes the date accessed to the current date and time, which in itself
> creates problems for auditing and compliance.
>
> I have searched knowledge base etc and cannot find any definition for
these
> basic file properties, what they mean in general, when they are set and
when
> they are updated. This is what I need to know: what the operating systems
> does, not what a programmer might choose to do but what happens when a
user
> goes about his normal business using eg Word.
>
> "David Craig" wrote:
>
> > If you do not have any specialized security software on the system, you
can
> > take those values to mean whatever the last person who set them or
caused
> > them to be set meant for them to mean. They can be set, reset, and
altered
> > by any file owner or someone who has the usual access rights to the
files.
> >
> > "david soussan" <david soussan[ at ]discussions.microsoft.com> wrote in
message
> > news:0BA598C9-4E89-47E2-ADBE-F47D70EFBA31[ at ]microsoft.com...
> > >I have a compliance problem and I need to know and be able to explain
to
> > > legal team the meaning of a file's Date Created, Date Modified, Date
> > > Accessed
> > > properties: what they are, when they are set and under what conditions
> > > they
> > > are changed/updated.
> > >
> > > It's funny but untill I had to explain this I always just took them
for
> > > granted. Now I realised that I am actually unsure what and when date
> > > accessed
> > > is changed.
> >
> >
> >
|
|
|