|
|
How do you preserve file timestamps and metadata when copying files? If you are reading this article you have probably discovered that copying files using Microsoft Windows will cause the new files to ('alter') the current date and time. You will also notice the last modified date remains the same. This explains why a files created date can be more recent than the last modified date. Why do file timestamps change? Microsoft Windows and other operating systems use a FAT (File Allocation Table) which is similar to the table of contents in a book. The information stored in the FAT includes a list of the files on the computer and their attributes. For each new file created the operating system assigns the current date and time and stores this within the FAT. When files are copied across a network, between folders or to an external storage device (hard drive, flash drive etc.) the operating system will automatically create new timestamps for those files. Its worth noting at that the files internal timestamps; often referred to as metadata, remain the same. Many don't realize there are two sets of 'metadata' or file timestamps for many file types. A number of software utilities have been developed which allow users to copy files and folders without altering the file system timestamps. Robocopy, XXCopy and Pinpoint Labs SafeCopy 2 are popular applications which allow users to retain file timestamps. After comparing these utilities and others many have come to prefer Pinpoint Labs SafeCopy 2; especially when there is a large amount of data or when the files are used in an ESI (Electronically Stored Information) production. You can find out more here. SafeCopy doesn't require the user to understand DOS commands or create scripts to perform common functions. SafeCopy also includes copy verification using an MD5 hash algorithm and immediately reports any errors. Another benefit of SafeCopy is its ability to easily resume cancelled or aborted jobs. SafeCopy is also useful if you need to copy files for an ESI production. SafeCopy includes a chain of custody and allows users to specify the folders and file types for collection. Litigators and corporate IT professionals are especially interested in preserving file timestamps and metadata. Due to the changes in the Federal Rules of Civil Procedure (FRCP) it’s important to produce electronic files without alteration. The changes in the FRCP mean that the producing party needs to take the necessary measures to preserve potential evidence. Additionally, the methods and tools used to produce electronic information can come into question more now than ever before. Using applications which preserve, validate and document the collection process is vitally important. If you are copying or collecting files which are involved in a legal matter than you should take a serious look at Pinpoint Labs SafeCopy 2 Mobile Edition. The software was designed with ESI productions and litigation in mind. You can learn more about 'forensically sound' file collections by reading the free 'No-Nonsense File Collection' report. SafeCopy 2 Mobile Edition runs from a USB flash drive and doesn't require the software to be installed on the target computer. The chain of custody log and MD5 hash verification provide additional documentation that the ESI production was completed properly. File timestamps are easily altered when using Microsoft Windows to copy files and folders. Be sure to research and compare the various copy utilities and determine what best fits your needs. |
|
Jonathan P. Rowe
President and CEO Pinpoint Labs www.pinpointlabs.com jon.rowe@pinpointlabs.com |
|