Using EnCase I can see the metadata for a Word file, but don't understand the format for any of the dates. The creation date does not match the time I find when looking at the properties of the file through Windows. I believe that it is just a format issue. The entry consists of 8 bytes, is it an integer? Windows time/date entry? Thanks for any feedback!
It is FILETIME. When you look at it via Hex, you are seeing it in UTC, but if you are looking at it via Word, it converts it to your local time zone. I believe that is the discrepancy you describe.
If you are talking about file system MAC times, I would attribute the difference in times to the document being created prior to being copied or moved onto the file system.
Thanks for the response, but it isn't just off by the timezone. If I try and convert it to Windows date/time, it is completely off. The month, day, and year are all different from the $MFT entry and the properties information.
Please disregard
It sounds as you figured it out, would you care to share information, if you have. Otherwise, an example would help us help you better.