Recently I have visited one the website published a data in row and column in pdf file format. I have noticed that after two days later on the data has been changed in one of the cells but file name is remain same.
My question is that
1. Can we check the date of medication of the file and any track record of the changes sequence with valid proof?
2. Is there any computer forensic tool or software to check the modification or overwrite the file details of the website?
On a website the last-modified information should appear when you make a HEAD http request on the resource. In linux you can do
Type (replacing both "grussell.org" with the name of the server and "/" with the file details):
telnet grussell.org 80
HEAD / HTTP1/1
Host: grussell.org
(then type 2 returns)
HTTP/1.1 200 OK
...
Last-Modified: Fri, 13 Jan 2012 10:36:12 GMT
ETag: "a5f-4b6666eff7f00"
Content-Length: 2655
The last-modified data should reflect the last modified of the file. Additionally if the file changes the ETag should change along with the length of the file. Sometimes some of the information may not be present, but at least the content-length is almost always there and will likely change, and usually the last-modified is present in a well-written system.
Simple enough to write a little program to do that.
I hope that helps.
Gordon.
On a website the last-modified information should appear when you make a HEAD http request on the resource. In linux you can do
Type (replacing both "grussell.org" with the name of the server and "/" with the file details):
telnet grussell.org 80
HEAD / HTTP1/1
Host: grussell.org
(then type 2 returns)
HTTP/1.1 200 OK
...
Last-Modified: Fri, 13 Jan 2012 10:36:12 GMT
ETag: "a5f-4b6666eff7f00"
Content-Length: 2655
The last-modified data should reflect the last modified of the file. Additionally if the file changes the ETag should change along with the length of the file. Sometimes some of the information may not be present, but at least the content-length is almost always there and will likely change, and usually the last-modified is present in a well-written system.
Simple enough to write a little program to do that.
I hope that helps.
Gordon.
Hello!
Eventually you could produce a hash signature of the resulting output (proposed by Gordon). You also need to have a kind of database with "file - hash signature" in order to check the file(s) integrity.
Regards,
Walter
The SANS Investigative Forensic Toolkit (SIFT) is an Ubuntu based Live CD which includes all the tools you need to conduct an in-depth forensic or incident response investigation. It supports analysis of Expert Witness Format (E01), Advanced Forensic Format (AFF), and RAW (dd) evidence formats. SIFT includes tools such as log2timeline for generating a timeline from system logs, Scalpel for data file carving, Rifiuti for examining the recycle bin, and lots more.
- Badges
- Science topic