Forensic Backup Exec

[Blastman2]

Hi to All,

I need some confirmation about the information provided in Backup Exec 12.5 for Windows Servers.

Which information has exactlly on Restore Job properties, View by Media TAB, Modified Date Column?

I'm involved in forensics investigation, this is an example without real info:

E-Mail sended 16/03/2014 13:00:00, backup made on 31/12/2014 22:00:00, and looking for e-mail on Backup Exec, I see for this e-mail on Modified Column Date 16/03/2014 12:40:00.

Can be possible?, Backup is overwrritable,  previous e-mail had the same date 16/03/2014 12:40:00. So I suspect that e-mail can be false, duplicated from previous one.

Are there some other possibility?

Thank you in advance!

[VJware]

The modified date in BE corresponding to emails has no relation with the email's sent or received date. If i recall, BE retrieves the modified date/time attribute from the Information Store and this date/time attribute is changed based upon the email being modified due to a reply, forward or a copy etc.
 

[Blastman2]

Thank you VJware,

But it's not enough clear for me, because the date showed on BE is 20 minutes older than email sending date. and Backup date is few months ago the mail sending. I would mean that there is no mail at 12:40, and system backed up it some months later. so I think that it's curious to have this date and no date related to mail.

BE Modified date is the same than other e-mail. I'm thinking that maybe someone duplicates it in order to create mail backup.Can be?

It's very important to have clear at all, because it's deterministic part of the work.

Thank you very much to all!

[VJware · Accepted solution]

Have you had a look at this KB - https://support.symantec.com/en_US/article.TECH201756.html  ?

[Blastman2]

Thank you a lot!