Origin of documents...
 
Notifications
Clear all

Origin of documents created

4 Posts
3 Users
0 Reactions
511 Views
(@bluedragon)
Trusted Member
Joined: 18 years ago
Posts: 60
Topic starter  

Will we be able to tell from a document the origin of a document?

Can we say that this MS Word document was created in this hard drive?

Or the best we can do was to tell the user that created that document?


   
Quote
(@csericks)
Trusted Member
Joined: 18 years ago
Posts: 99
 

It would be difficult to identify the origin of a document by looking at just that "original" file.

One would need to build the case for origin by finding/identifying supporting meta-data or multiple versions of that original file on that hard drive and tie all of that to a specific user. Then, one would need to find date/time and other artifacts to establish that that specific user was using the system at the time the "original" file, meta-data, and other artifacts were created. Of course, one would have to show that the account belonged to that specific user and that no one else had used that account.

It's a convoluted process that takes due diligence and case-building. There is no simple yes/no. Ultimately, and to partially answer your questions, one might or might not be able to determine the origin and/or the document's creator.


   
ReplyQuote
keydet89
(@keydet89)
Famed Member
Joined: 21 years ago
Posts: 3568
 

This can be a sticky situation, even with the amount of metadata available within OLE documents (assuming that's the version of MSWord you're referring to).

You would definitely need to incorporate other data, as well, in order to narrow down the probability and approach certainty with respect to answering your question.


   
ReplyQuote
(@csericks)
Trusted Member
Joined: 18 years ago
Posts: 99
 

I knew "H" would offer up good perspective. If you search through his postings and read his published offerings, you'll find a gold mine of excellent material to help you.


   
ReplyQuote
Share: