Document edited Date

Unless you have document tracking on in say, word, you're not going to see anything.

Whenever a .doc or a ppt is opened, a working copy of it is created in %temp%. That may give you some indication on when a document have been accessed.

If you want to see this, you need some sort of file system monitoring for changes or a document management system where all official documents reside since most of these track changes with revision history.

Hi!
I have several xls and doc files, …
I would like to know is it´s possible to gain more information in relation with those activity over that files, like all the times someone access the docs.
Many thanks for any help!

If these files are the new MS format (OOXML) - you can find out more about what you want by examining the internal xml metadata files. Not a very easy task to figure it out, but there is quite a lot in there.

The metadata for revision # is stored in ‘docProps/core.xml’
(rename the file from eg .docx to zip, and extract it) and are in the form

<dccreator>User 1</dccreator>
<cplastModifiedBy>User 2</cplastModifiedBy>
<cprevision>3</cprevision>

Furthermore, the list of actual revisions (revision IDs) is saved in ’word/settings.xml’ and they
correspond to the relevant wrsidR ‘s in ‘word/document.xml’ file where you can see what actually changed and the timestamps. Any possible user notes are stored in word/comments.xml

The rest of the metadata are stored in ‘docProps/app.xml’.

A good reference to check for more info on this, is this thesis
(Forensic Analysis of OOXML Documents)

The metadata for revision # is stored in ‘docProps/core.xml’
(rename the file from eg .docx to zip, and extract it)

Or use 7-zip to open the file without renaming it.

jaclaz

Hi!
I have several xls and doc files, (office files), where I know the basic own metadata, (eg, time creation, last updated and printed date). However, I Know that those files where edited several times, (often, only open the document, change some words and print, and then close without save it).
I would like to know is it´s possible to gain more information in relation with those activity over that files, like all the times someone access the docs.
Many thanks for any help!

No time to craft a proper reply but this is a complex subject and requires a lot of understanding to properly do it justice. A single Office .doc can be picked apart for hours and days by those with good understanding of the subject. A few useful starting points here http//www.forensicswiki.org/wiki/Document_Metadata_Extraction

Good luck.