http://www.websleuths.com/forums/sh...-General-Discussion-7&p=12759032#post12759032
pocketaccent's experiment just proved that changing the creation date is/was a piece of cake, plus there is also the whole question over the fact that when the memory card was run through Encase, it wasn't even write-protected. Now add to that that it appears from the testimony that only the shower pics had been embedded with the date/time stamp from the camera... the nudes were all done by Encase's software. Sure raises my eyebrows.
Going back to:
http://www.websleuths.com/forums/sh...-book-February-2016-2&p=12378939#post12378939
https://youtu.be/E9hvA3hQpBk
"Det.M says, starting at about 2:25 in this video, that he couldn't pull anything off the internal memory for TA's camera because he couldn't find anything saved to the internal memory. He also goes on to explain that for the memory stick(he briefly explains the difference between it and a sim card)
he was unable to use a write-blocker to pull the info off it. Therefore he plugged them directly into the reader to pull the info using Encase.
At 16:49 he says the date/time info on the unallocated pics was created by the Encase software report. JM has him verify that the date/time info for the shower pics came from the camera having imprinted them directly, but I didn't hear him say that specifically about the nudes, though the way they discussed all the deleted(shower) and unallocated(sexual) pics together they do seem to infer it, in fact he had just said that typically he wouldn't expect it from unallocated files. Now from what I've read on Encase, at least back in 2008, it tells you that it will give the last date accessed on the camera to unallocated files, therefore it would follow that thumbprints in unallocated spaces with no file left at all won't have anything, but those with partial files will be given the last date the camera was accessed."
http://www.websleuths.com/forums/sh...-book-February-2016-2&p=12379860#post12379860
"Quote Originally Posted by TexMex View Post
the images (except two which had been overridden) contained the date and time they were created."
<snip>
"the reason two sex pics don't have the red date and time stamp is because he could not recover even the meta data"
<snip>
"Again, if you read the Encase info, or pretty much any of the software available at that time,
it appears that it is up to the technician to decide which date applies when all of the metadata is not available, part of that being going by the dates they would deem most condusive to fitting within the timeframe that they were looking for and that the "creation" time could apply."
https://whereismydata.wordpress.com/tag/dates/
http://www.websleuths.com/forums/sh...-book-February-2016-2&p=12380269#post12380269
"In response to the jury questions Dworkin had said:
-----------
JURY QUESTIONS
1) are date and time stamps on photos taken by digital cameras, can they be manually manipulated?
Answer: the photo of the file would have to exist first and then go and change the time/date.
It applies to "exif" information as well.
Dworkin did not attempt to turn on the camera as it had been stored for a long time and there was no reason to do it at the time. Dworkin did not see any evidence of time stamp manipulation.
Martinez asks about #413,
is it possible that the photo of Jodi and her sister, could it have been taken in 2007 and then uploaded or downloaded in 2008? Witness answer :
"anything is possible"."
https://discussions.apple.com/thread/4987181?start=15&tstart=0
"Need original photo date vs. import date"
"morganda
Feb 16, 2015 10:04 AM
in response to Terence Devlin
Unfortunately the Mac OS finder does not allow one to view JPEG photos in a folder by file creation date as is possible in Windows because
Macs default to the modification date. On a Mac I have used Lemkesoft's GraphicConverter program as a work around. It does a great job in shifting/changing EXIF date/time stamps for batches of JPEG photos so that one can fix camera date/time setting errors and allows you to synchronize photos from different cameras. I have used it to change JPEG modification dates to creation dates for batches of JPEGs created from camera raw files. One simply selects pictures in a folder containing JPEGs within Graphic Converter's Browser, and then chooses the following two actions:
(1) Metadata EXIF, IPTC, ...
(2) Set EXIF Data to File Creation Date
After following this procedure, my photos sort by creation date in the Mac OS finder. This same procedure probably would be applicable to your situation."