When was it copied/deleted?

[AlpineSummit]

Is there a way to tell, looking at deleted files on a hard drive:
- when the file was copied to the drive?
- when it was deleted?
- if a cd was burned or the files were copied to another drive?

Thanks for any info!

[GDH]

Yes, there are ways to determine this information. However it is not an easy or simple process. You need to engage a computer forensics examiner to investigate the system.

Prior to doing this the most important thing is not to use the computer as you will be changing the contents of the drive and will make the task much more difficult. The first thing a Computer Forensics examiner will do is to take a forensic image of the disk (an exact copy) to preserve the evidence that is on the disk. He/She will then work on this forensic image.