No smilies, no avatars, no flashing gifs. Just discuss the issues of the day, from last night's telly via football to science or philosophy.
Started by demoninatutu on Oct 3, 2018 4:18:18 AM
I need urgent help dating a document

I won't go into details (well, maybe later) but I've been sent a Word document and I need to find out when it was created. Normally, you'd open Finder and click on Properties. But this reports the document was created when it was downloaded onto my computer, rather than it's true creation date. I guess this is something to do with differing versions of Word, or perhaps a document that was created with Google Docs. Any ideas?

demoninatutu - 03 Oct 2018 04:34:03 (#1 of 32)

I forgot to mention I'm using Word for Mac, version 16, on Mac OS High Sierra (13).

TinyMcOtter - 03 Oct 2018 04:36:45 (#2 of 32)

I have an older version of Word for the Mac, and I'm not sure whether this is reliable. But;

File > Properties > General

demoninatutu - 03 Oct 2018 05:42:20 (#3 of 32)

Thanks TinyMcOtter. That's exactly what I did but it gave me the time that I downloaded the file, not even the time that the email was sent.

It would very much be in this individual's favour if the document was created months ago and not, for example, last night. I wonder if it's possible to prevent this data from being attached but the strange thing is that even in my download file, the creation date is written as the download time.

I haven't had this problem with many other files but it has happened occasionally — and most notably from those with the most to hide.

Could it be a server problem?

quartus - 03 Oct 2018 05:47:32 (#4 of 32)

dating a document ...

trying to get between the sheets eh?

TinyMcOtter - 03 Oct 2018 06:15:59 (#5 of 32)


I think it’s picking up the time info from the time it ‘landed’ on your computer. I’ve nevwr completely managed to work out exactly when and how that strips the file’s date. Using Dropbox seems to preserve that info, other forms of file transfer don’t.

Otherwise, I think, each file format may or may not have its own date tracking info. Many graphics files, for example, have extensive metadata.

I’m not aware of if or how MS files do this. Have track changes enabled would probably help, but it’s probablu too late now.

It’s the kind of thing that Policywatcher would know.

OneOfOne - 03 Oct 2018 06:43:53 (#6 of 32)

Open it in word and look at the menu, File->Properties data which should give create and modification dates as stored in the actual file internal metadata rather than its system properties

demoninatutu - 03 Oct 2018 06:52:13 (#7 of 32)

Quartus , you Excel at document puns.

TinyMcOtter "I think it’s picking up the time info from the time it ‘landed’ on your computer." Yes that's exactly what's happening. My guess is that it's filling in data that wasn't already there when the file was sent. Blanking that data (which is possible) would be very much in the sender's interests.

"It’s the kind of thing that Policywatcher would know."

Calling PolWat, calling PolWat. I'll ask him on the IT thread if he doesn't find this one by himself.

OneOfOne Thanks OneOfOne, but those dates are given as when the document was downloaded to my computer. I assume Word filled them in automatically because it didn't have that data itself.

I want to be as sure as possible that this issue is a result of settings by the sender, rather than an issue at the server.

demoninatutu - 03 Oct 2018 06:56:24 (#8 of 32)

Sorry all, I meant to say 'Open File and click on Properties'.

LomaxFairchild - 03 Oct 2018 07:00:44 (#9 of 32)

Demon, assuming it has the docx extension

Download the Unarchiver App, right click doc, open with the Unarchiver. This will expand the document into a folder containing its contents.

Navigate to the docProps folder and open core.xml in a text editor. There should be created and modified dates in there.

LomaxFairchild - 03 Oct 2018 07:01:54 (#10 of 32)

demoninatutu - 03 Oct 2018 07:18:59 (#11 of 32)

Oh brilliant. Thank you.

demoninatutu - 03 Oct 2018 07:32:43 (#12 of 32)

I've since received a screenshot of the properties from the sender. It appears to be legit.

Thanks all.

Delighted_User - 03 Oct 2018 08:44:14 (#13 of 32)

Just out of curiosity – if someone wanted a document to appear to have been created earlier than it had been, wouldn't it be possible to set the date manually on the computer? How could you tell if this had been done?

thisonehasalittlehat - 03 Oct 2018 08:49:19 (#14 of 32)

Have you chosen a restaurant?

Delighted_User - 03 Oct 2018 08:50:21 (#15 of 32)


carterbrandon - 03 Oct 2018 09:00:35 (#16 of 32)

#13: The core.xml file inside it records created, modified, and printed dates, plus who modifies and how many revisions there's been. I haven't crawled all over Word metadata for ages, so there might be other things in there that can show discrepancies that a simple clock change wouldn't keep in line.

Not since a few years ago, when my boss gave me a document that his boss's boss had told me I should learn from. That gave me the motivation to find the three named people in the metadata who had took my original, changed the formatting and a few paragraphs, and passed it off as their own.

TommyDGNR8 - 03 Oct 2018 09:11:14 (#17 of 32)

If you've already got something like 7Zip on your computer then it'll do the same job as the unarchiver.

thisonehasalittlehat - 03 Oct 2018 09:12:50 (#18 of 32)

Dating. You see.

blacksunday - 03 Oct 2018 18:09:06 (#19 of 32)

<Thumbs up>

TheExcession - 03 Oct 2018 21:07:44 (#20 of 32)

Blimey, that's a bit much for a first date isn't it?

Check Subscriptions
Home » IT & Computers