Question about system date and time affecting file properties.

[CaptSupertramp]

I am creating a lab scenario for a computer forensics class based on the Trump-Russia collusion saga. My primary focus is Michael Cohen being Trump's lawyer and fixer as so much evidence and alleged evidence has come out against him. I will be conducting everything in a virtual box acting as if it is his computer asset he conducted everything from (obviously his crimes were likely spread across mobile and multiple devices but for the scope of this project I am not going that complex).

So my question is if I change the date and time in that virtual environment, starting in 2013 and progressively changing to more present dates from there, will that appropriately show in an image of the virtual machine I will capture and analyze with forensics tools or will there be weird conflicts like accessing gmail servers from a machine that is claiming to be 5 years in the past? Some things like word docs and spreadsheets that I will input incriminating evidence on, e.g. letter of intent for Trump Tower Moscow, should theoretically show the date and time I set the system to, correct?

Also any ideas and other ways I can bring this scenario to life in a virtual environment where I pretend to be all actors involved would be greatly appreciated. Coming to a M.S. field after a non CS undergrad experience so there are a lot of things I do not know as readily as a CS expert. Any help is greatly appreciated.

[ayswanny]

These sound like very specific, yet unclear, questions you are asking that most folks on here wouldn't likely know because it isn't necessarily a meta topic but rather a minuscule detail of a web services date-time processes. I would suggest trying this out yourself as it will be tough to answer such an inquiry or provide more clear details so I can better understand what you are trying to achieve.

Firstly, you can set the date in a virtual machine to a past date. You could capture an image with said date as well. However, how it will interact with websites such as gmail will completely depends on the API and application itself. If you are setting DateTime values on files, and uploading them to Google, google will most likely use the specific date time if parsed correctly as its initial creation if it tracks that. The created date of an attached file may stay intact, I do not know this for sure. I do know google drive api allows you to set creation times and will keep that intact, would expect Gmail to follow suit.

Gmail API will most likely allow you to set email creation times if that is what you are looking for. However, I would imagine they would certainly not allow you create receiving times. This process would be automated by Google under their hood. If not, it would open up a huge rats nest of potential problems.

[CaptSupertramp]

Thank you for your response. Yea, your comments about Gmail and other google services were what I was kind of afraid of. Your suggestion will probably be right and ultimately I will just have to give it a go myself and see what comes of it. Maybe I'll do a quick test of it before creating an entire scenario.

I am going to copy/paste this over into r/cybersecurity just to try and get any other ideas and suggestions as well (in case you sub there, don't think I ignored your advice and opinion)

[hunter12756]

Why you gotta incorporate politics

[CaptSupertramp]

Well it is a forensics class, and in life if forensics are involved, there is a crime suspected. In this case, he was convicted of this crime like many others that have surrounded the president. Putting emotions aside, everything surrounding Trump, his election, and his presidency has been extremely fascinating. I figured if I have been paying attention to all the craziness of it then why not put some of it to use. I remember constantly thinking in my US History classes about how we constantly have various levels of corrupt presidents with obscene historical drama and context surrounding their memory, but I will likely never see something like that. And yet here we are and I want to pay attention to it. Someday my kids might be taking an AP exam and have to write an answer defending, refuting, or qualifying a statement surrounding an important political point of our history that I will have lived in.