File creation date

[greenlandy]

I have a word document that I need to prove the creation date of. Unfortunately it was emailed to me and so states todays date when properties is selected. Is there a way of proving or finding out the original creation date?

Cheers in advance matt

[hut49]

greenlandy said:

I have a word document that I need to prove the creation date of. Unfortunately it was emailed to me and so states todays date when properties is selected. Is there a way of proving or finding out the original creation date?

Cheers in advance matt

OPen the Word doc and then go File / Properties and look at the statistics tab

[greenlandy]

That should do it thanks very much Matt

[randlemarcus]

Its not proof, per se, as those properties are reasonably easy to regenerate, but should provide assurance to your lecturer etc.
If you want to reset the file system date, try googling for touch.exe

[greenlandy]

randlemarcus said:

Its not proof, per se, as those properties are reasonably easy to regenerate, but should provide assurance to your lecturer etc.
If you want to reset the file system date, try googling for touch.exe

That's a bummer I'm trying to prove that some one has written this after the date they said they did.

[randlemarcus]

greenlandy said:

randlemarcus said:

Its not proof, per se, as those properties are reasonably easy to regenerate, but should provide assurance to your lecturer etc.
If you want to reset the file system date, try googling for touch.exe

That's a bummer I'm trying to prove that some one has written this after the date they said they did.

Is there a backup tape from that date? Its about the only way to be sure (aside from the obvious taking off and nuking it from orbit)

You can only go with the facts as you have them, in that you have a known timestamp of when the email system delivered the file to you. You cant even rely on the sent timestamp as thats quite easy to mess with. Its a bu99er this forensic analysis, isnt it?

[greenlandy]

Yes cause it's my job on the line but that's another story .
Thanks again for all of your help.

[hut49]

There's one other idea. Open the doc and switch on the Reviewing function and open the Reviewing Pane. If by any chance the author of the doc was using the track changes facility then the reviewing pane shows the date and time that edits were made to the doc.

[randlemarcus]

hut49 said:

There's one other idea. Open the doc and switch on the Reviewing function and open the Reviewing Pane. If by any chance the author of the doc was using the track changes facility then the reviewing pane shows the date and time that edits were made to the doc.

Relies on system time, so rewind the clock on the PC, edit and tada! this document was written three days before the deadline.

The only way that Greenlandy can prove that the document was/wasnt written is to examine a backup image from the backup window when it was alleged to have been completed. If it was the other way around, it would be easy to create "evidence" that the file had been created earlier. It might be possible to generate absolute proof of presence if the filename is greater than the old 8+3 character limit as this creates a second MFT entry under NTFS, but the sneaky person would then claim to have created the file on floppy, or FAT32 media. Well, I would