WORD 2010

Maybe your question should be posted in a Windows 7 help forum rather than a computer forensics forum.

Or professor google can more than likely help, although it appears this behavior has been around for a long time.

http//www.forensicfocus.com/Forums/viewtopic/t=1979/

I think that metadata field is only maintained on a save of the document. So if you print, then close without saving, it won't be updated. You need to print, then save the document. This is why you are asked to save a document if all you do is open it and print - the metadata has changed.

1. I think this is a helpful subject for forensic analyses. Because you can analyse document metadata but before it; making some experiments and seeing results can help us about our comments related with a case.

2. I save after printing although the program doesnt ask, but it still didnt update .

I think that metadata field is only maintained on a save of the document. So if you print, then close without saving, it won't be updated. You need to print, then save the document. This is why you are asked to save a document if all you do is open it and print - the metadata has changed.

I couldn't duplicate this behavior, after opening and printing there was no prompt to save, and even manually saving after printing didn't give an update on the last printed stamp. I have to admit my curiosity is aroused )

I hope our curiosity will give a result…)

So if you print, then close without saving, it won't be updated. You need to print, then save the document.

I'll second this statement. The print data only gets updated after the document is printed then saved. Check out my metadata charts.

http//code.google.com/p/jiir-resources/downloads/list

Corey Harrell
"Journey Into Incident Reponse"
http//journeyintoir.blogspot.com/

I save after printing although the program doesnt ask, but it still didnt update .

But you have not told us what file format you are testing. Word 2010 supports .. oh, around a dozen different formats. Which one are you using?

And you have not told us by what method or tool you establish that the print date hasn't change. We don't even know that it is a good one.

And you say that it doesn't happen as you expect, even with an explicit save. But other posters are saying that they can't repeat your results. Neither can I. That *is* interesting. Do you have any ideas for how to resolve that contradiction?

I'll second this statement. The print data only gets updated after the document is printed then saved. Check out my metadata charts.

http//code.google.com/p/jiir-resources/downloads/list

Corey Harrell
"Journey Into Incident Reponse"
http//journeyintoir.blogspot.com/

There must be specific circumstances where this works, as I said in my previous post print then save makes no difference to the meta data when I did it (Win 7 x64, Word 2007).

There must be specific circumstances where this works, as I said in my previous post print then save makes no difference to the meta data when I did it (Win 7 x64, Word 2007).

All my previous testing was on XP 32 bit with different versions of Office. The behavior matched what's reflected in my charts. I ran a few tests from a Win 7 64-bit Office 2007 (32-bit version) and the print metadata did change slightly. Below are my tests and the resulting print date

Created a new document, type one word, and saved it
No print date

Printed document and closed it without saving
No print date

Printed document and saved it
No print date

Printed document, modified document, and saved it
Print date was updated

Modified document, printed it, and saved it
Print date was updated

The slight change in behavior is the document has to be modified in addition to it being printed and saved for the print date to be updated. Not sure when I'll be able to circle back around to repeat all my testing on Win 7 64-bit, Office 32-bit, and Office 64-bit. I've since moved on to the IR side of the house and don't deal with fraudulent documents like I used to.

Corey Harrell
"Journey Into Incident Reponse"
http//journeyintoir.blogspot.com/