I just want to get some opinions on the overall usefulness of these timestamps in relation to MS Office documents.
They're very useful.
What I mean is how you use the OLE timestamps vs. the file system timestamps and what do you all find to be a more reliable timestamp to use for user timeline creation.
What I mean is how you use the OLE timestamps vs. the file system timestamps and what do you all find to be a more reliable timestamp to use for user timeline creation.
Neither is more useful - it depends upon the context of the investigation - if you are looking at a possible forged (pre dated) document then you are interested in which ever date does not make sense.
Paul's correct, it depends on the context of the situation, particularly when working with other artifacts on the system.