Last Printed Metada...
 
Notifications
Clear all

Last Printed Metadata

8 Posts
5 Users
0 Reactions
6,464 Views
Batfink
(@batfink)
Active Member
Joined: 16 years ago
Posts: 5
Topic starter  

Under what circumstances would you possibly find the last printed date to be before the metadata creation date of a Word Document?
Obviously if the local clock was inaccurate for either of these 2 events, but other than that?
Its possible these Word files were created from PDF's - could this account for it?


   
Quote
keydet89
(@keydet89)
Famed Member
Joined: 21 years ago
Posts: 3568
 

Can you share some context?

What version of Windows are you looking at? What is the version of Word? Is the document OLE format, or the newer PK/XML format? What are you using to retrieve the data?

Thanks.


   
ReplyQuote
Batfink
(@batfink)
Active Member
Joined: 16 years ago
Posts: 5
Topic starter  

The version of Windows is unknown as the files are in isolation. Version 2010 and 2013 of Word were used to create the files using the xml structure file type.
The metadata is visible from the files properties in Windows on my forensic box and is also confirmed by viewing the files in both X-Ways and FTK.


   
ReplyQuote
keydet89
(@keydet89)
Famed Member
Joined: 21 years ago
Posts: 3568
 

Great, thanks for the response.

Without context, however, it's difficult to do much more than simply provide possibilities and "maybes".


   
ReplyQuote
pbobby
(@pbobby)
Estimable Member
Joined: 16 years ago
Posts: 239
 

I can replicate that without context.

I created a Word document, printed it, saved it as a template (.dotx). Closed word.

I re-opened Word, created a new document based on the template, saved this as a document (.docx). Closed Word.

The metadata shows the Last Printed 2 minutes before the Created date.

Cool.

PS You dont even have to do templates - if a Word document has already been printed and you SAVE AS to a new file, then the Created timestamp becomes the time you Save As and the Last Printed metadata remains the same (it's not erased/wiped out by the Save As operation).


   
ReplyQuote
MDCR
 MDCR
(@mdcr)
Reputable Member
Joined: 15 years ago
Posts: 376
 

Move document from drive X to Y, creation date updates for the new drive, printed date stays the same.

Windows API can be used to set any normal filesystem timestamps, can be done with one line of code in .NET.


   
ReplyQuote
(@lcherne)
Active Member
Joined: 15 years ago
Posts: 9
 

Under what circumstances would you possibly find the last printed date to be before the metadata creation date of a Word Document?

This can depend on the version of Word.

Some ideas from Corey Harell's posts in this thread http//www.forensicfocus.com/Forums/viewtopic/p=6567921/

One scenario linked from the thread includes

Document Printed then Saved as new document


   
ReplyQuote
Batfink
(@batfink)
Active Member
Joined: 16 years ago
Posts: 5
Topic starter  

Thank you very much for your responses. I had thought that a 'save as' with a different name still retained the originating creation date, but no as you state - certainly with Word 2010 it does not.
Thank you.


   
ReplyQuote
Share: