Inconsistant PDF metadata
The suspected forged pdf document that I am working on has the Modified date (Filesystem) lesser than the Pdf creation date (info). Is this a clue for the forgery?
The pdf file is found in two different computers with the same "anomaly". It is "produced by" MS Word 10 and does have the section of XMP metadata XML (must be manually removed).
modified time (MFT) of two different copies of the same file
Thu Apr 27 205453.0000000 UTC+0530 2017
creation and modified time (info metadata, embedded inside the document)
I have tested saving a word file as pdf, the creation and modification for MFT and Pdf info are exactly same.
I am new to such analysis, any help or comment is highly appreciated.