Hello, and thank you to anyone reading this.
I have been a bit 'stitched up' by my employer, who, after challenging him on it has created a document in an attempt to retro-fit his reasons. I asked for the document but he has changed the date in the meta data to earlier that its real date of creation. It's a word document.
Â
Is there any way for me to show that it was changed, or what the real creation date was?
Â
Thanks in advance for any advice!
Goodday sir, madam,
I'm not a forensic investigator but a programmer in the process of learning about the forensic world - hence my presence on this forum. Please verify the format of your word document. If it is a docx then:
Check inside the .docx container (.docx is a ZIP archive) and search for files like:
docProps/core.xmldocProps/app.xmlword/document.xml
which may contain timestamps such as:
dcterms:createddcterms:modified- editing time or revision numbers
If the metadata was manually altered through Word, inconsistencies between these fields may appear.
If you have access to the system(s) where creation and modification happened then you will have additional options, but that's perhaps for later. Let's try this first. I'll be watching this thread in case you need help.
Edit: if the document was transferred to you or anywhere before you had it in your possession then store the transfer date-times. Basically you want to keep as much as possible data in case things disappear.