9 ms·
The OP talks about the size in kilobytes, not bytes. That will almost certainly give false positives, but if you limit the time range, it may not be that bad.
by Someone 4y ago
The OP talks about the size in kilobytes, not bytes. That will almost certainly give false positives, but if you limit the time range, it may not be that bad.
Not a bad idea for initial filtering, I think, but I doubt it would hold up in court on itself.
- tomhallett 4y agoAgreed - the goal isn't "the KB's prove you are guilty". It's metadata which serves as a means to reduce the number of computers you need to examine with a more complex/manual search (deleted files, temporary/corrupted files, word document history, interviewing the employee, comparing the material in the document with the role/responsibilities of the employee, etc).
- throwntoday 4y agoI think you're forgetting that he could just re-print the file once he had located which printer it was on to verify. Once verified it's the file in question, you could easily check which device sent it to the printer.