does anyone have an idea as to why the OLE Metadata and File System Metadata will report different times for the same file?
does anyone have an idea as to why the OLE Metadata and File System Metadata will report different times for the same file?
…because the times are different?
Seriously.
Even if it is the same document how would one show it as being created at this time and the other show it being created at a different time?
You might download timestomp, run
timestomp <filename> -v
which will give you the MACE values. Nice thing about timestomp is that it does not change any of the values. Note that there are FOUR timestamp values… none of which is worth the electrons used to save it. But they are better than nothing, I guess.
One possibility is that the file was moved from it's original location.
The file is created and saved in it's original location. This establishes the "created" time in the metadata. The MFT entry will show an identical created time. If the file is moved, a new MFT entry is created for the new location. It will have a "created" time indicating when the file was created in that location. Even though it may have the same file name it is a different and unique file as far as the MFT is concerned. At this point the created times for the MFT entry and the file meta data are different.
Other apparent anomalies are possible when dealing with metadata. These can usually be resolved by logically thinking through what the data really means.
In one case I was involved in an issue was made of some files bearing a metadata printed date that preceded the created date. Sounds like a problem, but there is a simple explanation. The file in question was created from another file (Save As). The first file was printed. The second never was. The created time would represent the time that the file was "Saved As" something new. Since the new one was never printed it retained the printed time from the original file.
Even if it is the same document how would one show it as being created at this time and the other show it being created at a different time?
Sure…Occam's Razor…the file was copied from one location to another.
Check the other metadata within the document…does it correspond to info on the system you're examining. Check the Registry info on the system…are there any indications of a user opening the document, and if so, when?
The following explanations should help
Understanding File Timestamps
http//
Preserving File Timestamps
http//
Respectfully,
Jon Rowe
jon.rowe@pinpointlabs.com