T&E Investment Group, LLC v. Faulkner

What happened

In federal litigation, the defendant sought to conceal the existence of an undisclosed Alienware computer that contained relevant evidence. To do so, the defendant used BulkFileChanger, a free tool available to the public from NirSoft, to alter the creation, modification and access timestamps on multiple files in bulk. BulkFileChanger can rewrite timestamps on any number of files in seconds, without specialist knowledge or technical training. The manipulation was detected through forensic analysis, and the court imposed an adverse-inference instruction and monetary sanctions. The case is particularly significant because it demonstrates that metadata manipulation requires no specialist skill: the tool used is freely downloadable, takes thirty seconds to operate, and leaves no trace visible to a non-forensic observer. Any document whose only timestamp evidence comes from its own system-level metadata is vulnerable to exactly this class of attack.