±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 0 Overall: 34081
New Yesterday: 0 Visitors: 182

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

RSS Feed Widget

±Latest Webinars

Last Printed Metadata

Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
Go to page 1, 2  Next 
  

Last Printed Metadata

Post Posted: Thu Mar 09, 2017 12:04 pm

Under what circumstances would you possibly find the last printed date to be before the metadata creation date of a Word Document?
Obviously if the local clock was inaccurate for either of these 2 events, but other than that?
Its possible these Word files were created from PDF's - could this account for it?  

Batfink
Newbie
 
 
  

Re: Last Printed Metadata

Post Posted: Thu Mar 09, 2017 2:03 pm

Can you share some context?

What version of Windows are you looking at? What is the version of Word? Is the document OLE format, or the newer PK/XML format? What are you using to retrieve the data?

Thanks.  

keydet89
Senior Member
 
 
  

Re: Last Printed Metadata

Post Posted: Thu Mar 09, 2017 2:22 pm

The version of Windows is unknown as the files are in isolation. Version 2010 and 2013 of Word were used to create the files using the xml structure file type.
The metadata is visible from the files properties in Windows on my forensic box and is also confirmed by viewing the files in both X-Ways and FTK.  

Batfink
Newbie
 
 
  

Re: Last Printed Metadata

Post Posted: Thu Mar 09, 2017 4:49 pm

Great, thanks for the response.

Without context, however, it's difficult to do much more than simply provide possibilities and "maybes".  

keydet89
Senior Member
 
 
  

Re: Last Printed Metadata

Post Posted: Thu Mar 09, 2017 7:11 pm

I can replicate that without context.

I created a Word document, printed it, saved it as a template (.dotx). Closed word.

I re-opened Word, created a new document based on the template, saved this as a document (.docx). Closed Word.

The metadata shows the Last Printed 2 minutes before the Created date.

Cool.

PS You dont even have to do templates - if a Word document has already been printed and you SAVE AS to a new file, then the Created timestamp becomes the time you Save As and the Last Printed metadata remains the same (it's not erased/wiped out by the Save As operation).
_________________
Blog: secureartisan.wordpress.com 

pbobby
Senior Member
 
 
  

Re: Last Printed Metadata

Post Posted: Thu Mar 09, 2017 8:27 pm

Move document from drive X to Y, creation date updates for the new drive, printed date stays the same.

Windows API can be used to set any normal filesystem timestamps, can be done with one line of code in .NET.  

MDCR
Senior Member
 
 
  

Re: Last Printed Metadata

Post Posted: Fri Mar 10, 2017 3:36 am

Under what circumstances would you possibly find the last printed date to be before the metadata creation date of a Word Document?


This can depend on the version of Word.

Some ideas from Corey Harell's posts in this thread: www.forensicfocus.com/...p=6567921/

One scenario linked from the thread includes
Document Printed then Saved as new document
 

lcherne
Newbie
 
 

Page 1 of 2
Go to page 1, 2  Next