Re: Microsoft Word File and Properties Information.



On Mon, 29 Oct 2007 13:37:02 -0700, David Cooper <David
Cooper@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote:

I received an e-mail last year that contained a Microsoft Word File whose
Properties File shows that it was not even first created until about 6 weeks
after it was allegedly written! Does anyone know how to get as much detailed
information as possible from the Properties Logs of a Microsoft Word File?
For example precisely when the File was first created? By whom? On which
Machine? etc etc


No, the properties stored in the file are completely untrustworthy for
any such purpose.

The "creation date", for example, proves nothing about when the
document was written. It could have been written in another file and
then the File > Save As command could be used to save it to a new file
name; the "creation date" of the new file would be the date of the
command, not the date the material was written. Similarly, the command
Insert > File could be used to place the text of an older document
into a new file.

For the most part there is no such thing as a property log in an
Office file, which saves only the latest information, not an ongoing
list of actions. The main exception is the Track Changes feature, but
again that's easily manipulated.

There _may_ be a unique identifier in the document, associated with
the MAC address of the network card on the machine where the current
file was created (subject to the same caveats as the creation date),
but the user could have turned off the option to create the
identifier, or could have removed it with the Remove Hidden Data
add-in (http://support.microsoft.com/?kbid=834427).

Basically, for forensic or legal purposes, a Word document isn't worth
the electrons it's printed on.

--
Regards,
Jay Freedman
Microsoft Word MVP FAQ: http://word.mvps.org
Email cannot be acknowledged; please post all follow-ups to the newsgroup so all may benefit.
.



Relevant Pages

  • Re: Date/time stamps on files copied via LanMan98
    ... If you perform a copy from filer or command line ... it will set the creation date to the current date. ... It may complain because it can't set the ownership ... but I've never heard of other filesystems complaining. ...
    (comp.sys.acorn.networking)
  • Re: how can I use "find" command to locate new created file in a certain directory??
    ... Either track the file creation yourself inside your ... command you can sort out the files depending on their access date and / ... or modification/change date. ... -atime is access time ...
    (comp.sys.sun.admin)
  • Re: Date/time stamps on files copied via LanMan98
    ... If you perform a copy from filer or command line ... it will set the creation date to the current date. ... restamp copied files, but I use cp -a to copy attributes too. ... It may complain because it can't set the ownership ...
    (comp.sys.acorn.networking)
  • RE: Date/Time stamp of new & modified records
    ... My field name is Modify Timestamp. ... > Command Button named Update Record to execute this event each time a record ... Does, or can, the code execute each ... In each table I have both a Creation Timestamp and a Modify ...
    (microsoft.public.access.gettingstarted)
  • Re: which lpar am I on?
    ... LPAR information is provided by the 'prtconf' command. ... command that returns a unique identifier? ...
    (AIX-L)