cancel
Showing results for 
Search instead for 
Did you mean: 

Backup Exec and Forensic Research

stuffie
Level 2

Hi,

For forensic research, we need to restore files with original (creation) dates. Is there a way to do this?

Stefan
Holland

Backup Exec 2010

4 REPLIES 4

VBU
Level 4

Hello Stefan,

 

The files restored will have the creation date as original only. the creation date shouldn't be changed ideally modified date will be changed.

stuffie
Level 2

creation dates are changed, modified dates not. 

But it doenst matter, all dates must be correct, otherwise it will not be excepted as evidence in court.

teiva-boy
Level 6

So in hindsight, this firedrill you are going through, BackupExec isn't going to help you.  However, with a signed affidavit as a "subject matter expert," you can pass off files with different date/times and present in an ediscovery request.  I've done it, and have had to sit through a few depositions in the process to argue the technical validity of the process.

Going forward, if you are going to have to do this often.  You need a real archiving product.  One that not only can archive static files, but also search and discover active files.  Autonomy, Mimosa, and Kazeon (Preferred) will do that.  Not only can you search for what you need in network shares and down to the desktop, but they often integrate into backup apps too, to search in the catalogs.

Once you've discovered them and found them, you can then put a legal hold on them and store them in a repository for further review all while preserving the chain of custody.

stuffie
Level 2

Ok teiva-boy, it's clear now. I think (hope) this isn't going to happen often, so there is no need to switch to another product.

Thanks for your help.