I would like to know if the following is possible:
Is it possible to detect a file that has been put into my file system using back dating? Are there any trace artifacts left behind which can help to detect this sort of tampering?
Is it possible to detect file tampering? I mean this in terms of content, file created/modified etc, deletion. I am especially interested to know if we can find if a file was deleted and how I can detect the same.
The background of these questions is against a friend's stolen laptop and we need to figure out if any forensic file activity can be performed. I was most keen on the above mentioned 2 questions.
I would appreciate if both Windows and Linux tips were included.