The document may have been created originally on one computer, and then later transferred to another. The most recent file creation date (in the General tab) indicates when the file was first saved on that computer. The oldest file creation date (in the Statistics panel) indicates when that file was first created originally, on the original computer. To validate this theory, create a Word document on one computer, and check the file creation times. Wait a few minutes, and then copy that file to another computer. Check the file creation dates. You will see that in the General tab the creation dates represent when the file was created on that computer. In the Statistics (or Advanced) tab you will see that the Word document carries with it when it was first created, on the original computer. Hope this helps, Mike -----Original Message----- From: daniel heinonen [mailto:d.heinonenat_private] Sent: Tuesday, July 03, 2001 9:33 PM To: forensicsat_private Subject: Re: File times? Hi Martin, Go into windows explorer right click and create a new document. I then double clicked on this document and looked at file - properties and come up with the following results. General tab: Wednesday, July 04, 2001 10:20:47 AM Friday, August 01, 1997 8:37:00 AM Wednesday, July 04, 2001 10:21:53 AM Statistics tab: Wednesday, July 04, 2001 10:21:00 AM Friday, August 01, 1997 8:37:00 AM Wednesday, July 04, 2001 10:21:53 AM I then went to word and made new document waited a few seconds and then saved as and then looked at the properties and the following results occurred. Notice how the statistics tab created time is before the others. This time is when the document is first created but before it is first saved. I could not find any Microsoft documents about these times but i didn't really look that hard. General tab: Wednesday, July 04, 2001 10:25:41 AM Wednesday, July 04, 2001 10:25:41 AM Wednesday, July 04, 2001 10:25:41 AM Statistics tab: Wednesday, July 04, 2001 10:25:00 AM Wednesday, July 04, 2001 10:25:41 AM Wednesday, July 04, 2001 10:25:41 AM BTW the first time is created, second is modified, third is accessed . My windows time is set to 10:25 AM July 4 Wednesday. I do not know where the computer got the august time from. I am assuming it got the time from the Winword8.doc file as this file is the only one on my computer with the above date on it. I would also be able to generate the dates found in your email if i changed the computer time to say 10th opened word and a new document changed the time on the computer pressed save (save as will not work) then change the time again and you can print etc.. example of a totally stuffed up word document can be seen below. General tab: Wednesday, July 05, 2000 11:27:57 AM Wednesday, July 05, 2000 11:27:58 AM Wednesday, July 04, 2001 11:28:37 AM Statistics tab: Friday, July 07, 2000 11:27:00 AM Wednesday, July 05, 2000 11:27:58 AM Wednesday, July 04, 2001 11:28:37 AM I just made this file a few minutes ago and it says the total editing time is 4294964419 Minutes. Go figure. Please let me know if any of this works, i am using word 2000 but i do have access to 98 if you wish me to do the same tests -Daniel Heinonen At 10:54 AM 29/06/01 -0400, you wrote: >Good Morning All, > >Using Windows NT 4.0 file manager to review the file properties for files >located on a floppy I came across something I don't understand and hope one >or more of you may have an answer. > >The GENERAL tab of the file properties gives you the created, modified and >accessed dates and times for file. > >The STATISTICS tab also gives you the same categories but also gives you a >printed date and time. > >For one of the files that I'm reviewing, the created date and time are >different between the GENERAL and STATISTICS tabs. The GENERAL one is July >7, 2000 and the STATISTICS one is July 10, 2000. The printed field >indicates the file was printed on July 9, 2000. > >Does anyone know why the created dates could be different for the same file? >How would I explain how a document could be printed before it is created? > >I am confident that someone out there has ran into this before and I >apologize if this has been covered previously. > >Respectfully, >Ava M. Martin > >email: ava.martinat_private ----------------------------------------------------------------- This list is provided by the SecurityFocus ARIS analyzer service. For more information on this free incident handling, management and tracking system please see: http://aris.securityfocus.com ----------------------------------------------------------------- This list is provided by the SecurityFocus ARIS analyzer service. For more information on this free incident handling, management and tracking system please see: http://aris.securityfocus.com
This archive was generated by hypermail 2b30 : Thu Jul 05 2001 - 16:52:12 PDT