Meet Our Team 

 

Read Our CV's 

 

MCLE Training  

 

Client Testimonials 

 

Expert Witness Testimony 

 

Contact Us 

 

Tell Us What You Want to Know 

 

 

February 2012 - CACJ (California Attorneys for Criminal Justice), Monterey

 

March 23, 2012 - ACFLS (Assoc. of Certified Family Law Specialists) Conference, Rancho Mirage, CA  

 

Spring 2012 - NACDL (National Association of Criminal Defense Lawyers) Technology Seminar, Las Vegas

 

 

 

Our job is to provide you what you need to best serve your clients. Whether it's through our computer forensics or e-Discovery investigations, or our informative newsletters, we want you to have the latest and most current information.

In this edition, we have covered "When WAS That File Created?" and "Understanding Date Stamps".

 

We want to write about topics that you can use in your day-to-day practice.  Please e-mail us your topics of interest at admin@DataChasers.com.

 

We encourage you to share our e-newsletter with others in your sphere of influence.

 

Sincerely,

Rick Albee, CFCE,  EnCE      

 

Contract disputes, downloaded pictures, probate matters...what do they all have in common? Frequently at issue is the date a file was actually created, modified, or last accessed. This is a question in nearly every forensic case we work, and it requires a look at metadata. Metadata is data about the data. It is the information about the file, not the information in the file. Let's use a Word document as an example. The metadata information is stored by both the Word program and Windows (the OS...Operating System), but the information is more reliable when examined in the Word metadata. For example, Windows saves what it calls the Created date when you save the document, not when you open the program (the blank document) to begin typing; you can view these properties, incorrectly labeled metadata, in Windows Explorer. The true metadata Created date is saved by Word the moment the document is opened for creation; this date is not visible in Windows without a forensic tool. And more importantly, Windows OS properties change... Read More 

 

 

Imagine this: 

 

A document's Windows properties indicate that the document was created after it was modified. How can anything be modified before it is created?
A picture's properties in Windows tell us that the picture was last accessed before it was created...how can this be?
How does this happen? Is it a phenomenon? Have we entered a dimension not of sight nor sound, but... the Twilight Zone?

 

Here's how.  A file, transferred from one piece of media to another (copied or moved) is assigned a new created date when it is created on the new media. Generally, the modified and last accessed dates remain as they were on the original source media. Therefore, if I create a document on my computer, then send it to you as an attachment in email, and you leave it in your Inbox for several days, then save it to your HDD, Windows properties will give the document the created date of when you saved it to your HDD. The other date stamps generally remain the same. This means that ... Read More

 

DataChasers® provides the legal community full-service forensic computer and e-Discovery investigations. When you choose DataChasers®, you choose experienced examiners, holding multiple certifications, providing personal attention to the individual needs of your case. We are well-versed in the litigation process and offer experienced litigation support services. Our examiners are recognized expert witnesses and court-appointed neutrals who have taught computer forensics, lectured extensively, and published numerous articles on the subject. ...Read More

Our Mission:

Focus on the client's needs; exceed expectations; do the right thing. This is our reputation. We believe it is the most important thing we offer our clients, followed by our experience, certifications, and background. We help you learn the truth, eliminate surprises and win more cases.