How to modify OS intallation date?

>Forensics experts often check file modification dates and OS installation dates when digging through a suspect's disk or computer >On Windows, accessing a file's properties updates modification date How do you change the date that the OS reports as installed? How do you change a file's timestamps? What authentication methods are used to prevent this? Do you have to be offline?

>>18157 Use a free and open source operating system that allows you to change those parameters yourself. >>18161 Back to plebbit.

>>18161 I forgot to trip user, but I unironically have considered getting a job hunting down pedos. Nevertheless, I would like to issue a disclaimer that this IP, all IPs associated with it, and any devices associated with the aforementioned IPs are discussing purely theoretical research methods. These methods, and any IP's, devices, and infrastructure used in order to implement them, as well as any other tools, software or harder, that may be present, are used in the context of a completely legal test lab environment. >>18162 How would you do it on Linux? Assume I'm new but I have a baseline. Are you saying it can't be done on Windows?

Could you explain why this even is a concern? I'm just assuming but changing the system's calender date temporarily then turning it back after the date was updated may be a way to do it.

>>18183 We're talking in context of court trials here. Computers and phones are used as evidence literally all the time, but no one even understands. In court, it becomes a circus because the average person does not have the capacity to understand digital forensic evidence. I'm reading a book on computer forensics right now. It says that a key part of a forensics investigation is viewing file access dates, once you have the suspect disk imaged. Access dates are very important in cases like these. There was one case in my book where the suspect took files from his employer but claimed not to have touched them. Pedos who get caught love to argue that they haven't touched the files on their disk, and don't know how they got there. >Companies have large networks which log access, modification, and OS install dates Obviously, changing an OS install date in a centralized log would require hacking the entire network. You need like the highest level of permissions to do this. It's probably nearly impossible to do on Windows, let alone a corporate network. >So what is the point? Investigators have to make sure evidence is admissible and relevant. If there is evidence that the access date was fuarrrked with, the evidence becomes non-admissible. This is favorable to the defender. FOR EXAMPLE! That's why it matters.

>>18185 Oh I see. I was just curious what access date is relevant to but I suppose I can see how it's a focus. Instead of changing the date would it be possible to make it so the dates never get updated for any file?

you can set the "noatime" flag on your file systems. If you want to also create a fake atime tag, first run "touch" on each file in your system. If you're on Windows, lol good luck buddy

If what you want is to ensure for some reason that the metadata and contents of your computer's files can't be used against you, I've got bad news. If they want you to hang, you will. If you're truly concerned, use computers with no local state, read-only filesystems, access secret accounts only over proxies or tor, and make sure secrete data will self-destruct if you don't touch it for a while.

>>18157 >xhe doesn't mount xir disks with noatime. >2015+6 >still being retarded

>>18157 https://docs.microsoft.com/en-us/windows-hardware/drivers/ddi/ntifs/nf-ntifs-ntsetinformationfile https://docs.microsoft.com/en-us/windows-hardware/drivers/ddi/wdm/ns-wdm-_file_basic_information >>18162 wew lad