I will be giving a deposition involving some intellectual property issues in the near future, and some of my work is being considered as prior art. One of the ways we are determining "when" I wrote things will be based on the last changed dates of the files. Our AFS cell dates back to the early 90s (which is when I got my AFS admin certification.)
The question may arise, is how easy is it to "fake" these file system time stamps - do they come from the AFS client or from the AFS file servers? Off hand I could see setting the date way back on a Unix host (not an AFS client), writing out some files, making a tarfile of the result, and then untarring it on an AFS client would produce appropriately "faked" timestamps. Are there other indicators (volume time stamps, etc) that would detect that forgery attempt? Although I am an AFS admin, I am not the primary administrator of our cell, that role has been handled by others. I am quite confident that we do not have viable backups of the cell going back 10 years (even if we have the media, we may not have a drive to read it). There are secondary indicators of dates (papers published, newsletter articles, etc) that would indicate that we were indeed working on the projects demonstrated by the file system timestamps. This being my first in depth exposure to the federal courts, I am uncertain of the evidentiary value of computer files - I have files on my laptop with dates in the 90s, yet the laptop was manufactured in 2007.... Jon Finke - Senior Systems Programmer Communications and Middleware Technology - Rensselaer Polytechnic Institute VCC 319 / 110 8th Street / Troy, NY 12180-3590 518 276 8185 (voice) - 518 276 2809 (fax) - http://www.rpi.edu/~finkej <http://www.rpi.edu/~finkej>
