Word/IT chaps - can I check for certain the date a Word file was created?

[airborne_artist]

I need to check for certain the date a Word file was created - not the time it was last edited.

It's come from a PA in a large public-service organisation, so it's fair to assume that it has not been doctored.

When I look at Properties -> Statistics it says "Created: 07 January 2010", yet the date on the letter says 08 Dec 2009. The posted copy of the letter never arrived, and I'm starting to wonder if it was actually done at the time, or if someone is attempting to cover their tracks? Remarkably the creation date of the letter coincides exactly with the date I complained that I had not received a reply.

Thoughts, please.

[mixture]

What is the NTFS creation date ?

[mad_jock]

Some daft bint is attempting to cover her tracks.

Proper IT savy PA's will mess with the system clock so the creation date will be correct then stick a footer on it saying dupicate copy.

As a note to yourself don't send word docs back. It is very easy to tamper with them. Always send PDF files and create you own reference numbering system for all correspondance. eg gas/2010/0119 or gas/2010/001 and always ref to that when you refer to a previous letter. It will ring warning bells that a lawyer has told you the system for a complaint to there regulator.

[mixture]

It's quite easy to tamper with PDF files too if you don't save them correctly...(but even then....)

anyhow, that's a sory for another day.... :ok:

[airborne_artist]

What is the NTFS creation date ?

Where will I see that?

[mixture]

Right click, properties and it's listed there.

(at least it is on XP, not infront of anything more trendy like Vista or 7 at the moment !)

[mixture]

If you want to have some extra fun, you could also try a metadata viewer.

e.g. Pinpoint Labs - Computer Forensics Software and Services (http://www.pinpointlabs.com/new/utilities.html)

(note i have not used the software above, so the link is not a recommendation, found it via GooGoo search for "word metadata viewer" - without quote marks)

[airborne_artist]

If you want to have some extra fun, you could also try a metadata viewer.Downloaded the one you suggested, but to run the metadata app I had to save the file, and then the file creation date is today. How can I look at the file I was sent, rather than the saved version on my HD?

[mixture]

hmm... good point.

What email software are you using, or are you on gmail / hotmail etc. ?

[airborne_artist]

Received the file as an attachment into Outlook 2002 SP3 version 10.xxxx

[Saab Dastard]

It seems to vary, depending on how the original file was constructed, as to whether the creation date is retained across "importing" the document from an email attachment.

If you open the attachment from within the email, you should be able to see the original statistics, as you haven't saved the file - at least this is true for OE.

Even if the creation date is the date you saved the file, you should still see the Last Printed time.

Bear in mind that the information can be highly misleading - if someone takes an existing document, Saves As and effectively creates a new document from that rather than using a template to create a new doc, the stats can be months or years out!

SD

[mixture]

Received the file as an attachment into Outlook 2002 SP3 version 10.xxxx

Can't try this myself at the moment, but the answer might be to save the attachement by through "Save Attachement" (File menu I believe), and rename the file slightly from its original name.

Hopefully the file should then be saved with its original date.

[airborne_artist]

Hopefully the file should then be saved with its original date.

It was. Gives the same data as Word did. The PA to the head shed of the organisation has some explaining to do, but she's in good company. She's the fourth person in that organisation to have "problems with the truth" :}

[airborne_artist]

Apols for replying to my own reply, but it just got odder still.

I asked the secretary to a lesser, but still quite important person in the same organisation to send by email a copy of the letter that her boss said had been sent out, which mysteriously had also not arrived before Christmas.

The letter is dated 18 Dec, but the file was created at 10.04 this morning. The other "odd" letter was dated 8 Dec, but the file created on 7 Jan. I did not receive that by email until last week.

Is there any possibility that the sending organisation's IT system is causing this apparent case of @rse-covering, or are these two both telling porkies? What does seems possible is that they have copied them from say a network drive to a local drive, and that has given the file a new creation date.

Neither letter arrived by snail-mail.

[mad_jock]

It could be a document control system in action.

Each different type works in slightly different ways, its not outside the realms of possibilty that it would recreate the document from the database instead of copying the original one.

[Mac the Knife]

"....can I check for certain the date a Word file was created?"

Certain certain? As in legally certain? No.

Far too many ways it can be fudged.

:(