Why is MAC data considered unreliable as primary forensic evidence?
◦ Every time the file is opened, the Create date changes.
◦ Users can easily modify that information.
◦ Opening the file in a different version of an operating systems restarts the Create date.
◦ Access and modify dates are not treated the same way by applications as they are by the OS.