Are you sure of that date?

Are you sure of that date?
During a recent meeting, you wanted to know when a Word document was created so you looked at the properties of the file, by right clicking the file and clicking on the property tab. This provides the Last Accessed Time, Last Modified Date, and Created Date for the document. The question is, should you trust those dates for any decision-making?

Since you are the one who created the document, you feel comfortable that the dates are correct, but don?t be so sure. Whenever a document is moved from your thumb drive to your hard drive or back from the hard drive to the thumb drive, the ?Created Date? will change– this is because files are being moved from one partition to another and the Master File Table or File Directory Listing for the drive has to be updated. This is also true when a file is moved between two partitions or drive letters on your system?s hard drive.

What if instead of creating the document in question the file was given to you? You should feel even less comfortable or down-right cynical about the date. Remember, the Created Date will change when the file is moved from the other person?s system. How can this be checked? From a Microsoft Word Document, select the Tools tab, select the Macro folder and select Macro option. In the Macro function, select the Word Commands from the Macros In: drop down tab. Then go to the Macro named FileSummaryInfo and click the run button. The screen shows you the name of the document and the Author but not the Created Date. Click on the statistics button to reveal the creation date on the document with the last saved time and date is listed on the tab.

What if the file did not have a date on the FileSummaryInfo tab or you are still very suspicious of the person that gave you the document? What can you do to check this document further? The inner ?techie? in you remembers the metadata reader program installed on your desktop/laptop. There are several programs that can read all of the metadata for a file, one of the most well known is the Metadata Assistant from Payne Consulting. Payne is a Microsoft Partner and also has many additional Metadata Assistant programs for other types of files like Lotus Notes or Groupwise.

With the Metadata Assistant (MA), you can check out many of the other attributes of the file to see if the data and dates correlate to the timeline and match the story that you have been told about the file?s history. The MA program will show you the Time Last Saved, Time Last Printed, Last Saved By, Revision Number, and the Last 10 Authors (if the information is available) among the other technical information about the file. However, one new problem is that not only can the MA can find the information, it can also erase the information from the file. This cleaning process is a common occurrence now, or should be, when sending files to someone that may be your adversary in court or even sending information outside of your own organization. How then, can you be sure that the information provided is accurate and unaltered?

Since there is no information on the file, the next step might be to use the information listed on the File?Properties-General tab (remember ? right click and select the properties option). But wait; Febooti?s FileTweak program can change the File Created, File Modified, and File Accessed to anytime in the past or future. If the date does not seem right in the past or is in the future, what is the next step?

Now is the time to call in a Computer Forensic Expert so he or she can look at the entire computer system and report back to you about the authenticity of your document.

Now, ask yourself again if you are still sure of that date?