I made a sad discovery when correcting a computer-based exam, two students, I call them A and B here, had identical answer files leading me to suspect cheating. I looked closely on the file properties, Created/Modified/Accessed, and saw that B's files had the Modified-property earlier than the Created-property on all his files, implying that all his files were copies and not original files. A's files had all his Created-properties being the same as his modified-properties indicating that all his files were originals. Furthermore the modified-properties of student B's files matched exactly the modified-properties of A's files.
My question now is, is there any way that student B's files may not be copies of student A's files, or is the above described situation to be regarded as a conclusive evidence that B's files are indeed copies of A's files?
Though it's nearly impossible to "confirm" they are copies without comparing the files in a hex editor, looking for identifying marks (depending on the software used to create the files), that certainly seems to be pretty conclusive evidence, though circumstantial in a court case. Being they are students, it's certainly enough to ask some serious questions.
Something else to think about - when you are viewing the files, is anything ever modified? If so, this could throw off the MAC (Modified Accessed Copied) dates. I've noticed that frequently, depending on the file type, the MAC attributes will change just by simply viewing the file. Some programs save header information and such, modifying the file by simply opening it.
You're most welcome. Being text files, and assuming you are opening them up in a simple text editor, they shouldn't have their MAC values modified by simply opening them (sans the Accessed one). The Created and Modified stamps should stay the same.
The fact that 2 of the files have the exact same Created stamps is certainly another nail in the coffin. You are correct in assuming files moved via drag-and-drop will have the same created dates, yet retain the modified dates. If you have a file that has a modified date before the created date, it's obviously a copy of the original file. (You see this frequently within Windows system files, as they were installed and created after actually being made.)
Best of luck on Thurs - I think you are at the correct conclusion based on what you stated. Again, circumstantial in court (as MAC stamps can easily be modified with software), but in this case, it's as close to a smoking gun as you're going to get without a confession.
The files are C-source code files, in text format, content coinciding exactly except in one case where a "\n" has been, it seems, added to produce a different layout when the program runs. The MA-data also coincide exactly, I studied them through the "Properties"-dialogs and I did not have to open the files to conclude that the MA-data coincide. Further more, two of the files of B (whom I suspect having copied A's files) also have the exact same Created-date, to the second. This, I believe would indicate that the files were copied using drag-and-drop, thus creating two files with one mouse move with the same Created-date.
This is sad, but I see no other reasonable explanation than cheating. We are meeting a disciplinary committee on Thursday. Your comments have been valuable. I hope that the proceedings there will be long-term benficial to all, even though it is probably going to be very painful, especially for B.