03-21-2013 07:47 AM
Hi,
For forensic research, we need to restore files with original (creation) dates. Is there a way to do this?
Stefan
Holland
Backup Exec 2010
03-21-2013 08:22 AM
Hello Stefan,
The files restored will have the creation date as original only. the creation date shouldn't be changed ideally modified date will be changed.
03-21-2013 11:25 AM
creation dates are changed, modified dates not.
But it doenst matter, all dates must be correct, otherwise it will not be excepted as evidence in court.
03-21-2013 11:42 AM
So in hindsight, this firedrill you are going through, BackupExec isn't going to help you. However, with a signed affidavit as a "subject matter expert," you can pass off files with different date/times and present in an ediscovery request. I've done it, and have had to sit through a few depositions in the process to argue the technical validity of the process.
Going forward, if you are going to have to do this often. You need a real archiving product. One that not only can archive static files, but also search and discover active files. Autonomy, Mimosa, and Kazeon (Preferred) will do that. Not only can you search for what you need in network shares and down to the desktop, but they often integrate into backup apps too, to search in the catalogs.
Once you've discovered them and found them, you can then put a legal hold on them and store them in a repository for further review all while preserving the chain of custody.
03-22-2013 07:39 AM
Ok teiva-boy, it's clear now. I think (hope) this isn't going to happen often, so there is no need to switch to another product.
Thanks for your help.