Information Technology Reference
In-Depth Information
prevailing.in.this.case..However,.she.also.needs.to.prove.the.
contrary—that.the.defendant's.evidence.is.false.and.was.not.
created.when,.where,.and.by.whom.they.are.asserting.
In.our.imaginary.case.(which.I.admit.has.its.basis.in.several.
different.cases.I.read),.the.forensics. experts. for.the.plaintiff.
ask.for.and.receive.complete.sets.of.records.from.the.defen-
dants'.computers.and.begin.creating.a.timeline.of.events.to.
try.to.understand.the.discrepancy.between.the.assertions.of.
their.client.the.plaintiff.and.those.of.the.defendants.
They. are. looking. through. the. manager's. computer,. and.
they. are. noting. regular. and. expected. activities. on. a. daily.
basis..They.can.see.when.he.logged.in.for.the.day,.when.he.
went.online.and.checked.his.e-mail.and.his.stocks,.when.he.
did.some.Google.searches,.when.he.worked.on.some.docu-
ments,.when.he.created.and.sent.e-mail,.and.so.on.
The.timeline.goes.along.pretty.normally,.but.for.some.rea-
son.on.the.day.that.the.alleged.e-mails.and.the.contrary.doc-
ument.were.supposed.to.have.been.created.and.sent.they.are.
not.inding.any.evidence.of.that.activity..So,.they.go.into.the.
MFT.looking.for.the.creation.time.and.date.of.the.document.
in.question,.and.there.it.is.with.approximately.the.right.time.
and.date..Now.this.is.a.puzzle.and.an.anomaly.and.experts.
do.not.like.those.
They.next.take.a.look.at.some.event.logs.for.the.day.in.
question,.and.again.there.does.not.seem.to.be.any.evidence.
of.the.application.that.was.supposed.to.have.created.the.doc-
ument.having.been.opened.at.that.time.and.date..Being.the.
careful.sleuths.that.they.are,.they.look.further.and.deeper.and.
suddenly.they.ind.something.of.extreme.interest.
On. a. day. several. weeks. after. the. supposed. day. of. cre-
ation. of. the. document. in. question,. the. event. logs. show. an.
odd.thing..The.time.clock.on.the.computer.is.set.back.to.a.
day.2.weeks.earlier.for.a.short.time.and.lo.and.behold,.the.
application.that.created.the.document.is.ired.up.during.that.
window.as.is.the.e-mail.program..After.some.time.goes.by.
those.applications.are.closed.again.and.the.time.goes.back.to.
normal.and.proceeds.in.a.regular.way.
