Using the Windows ver 12.56 to look at a Word document. I'm getting different times for the Create and Modify Date than what is reported by the Preferences in Word. See below.
ExifTool Version Number : 12.56
File Name : {redacted by me}.doc
Directory : .
File Size : 40 kB
File Modification Date/Time : 2023:02:15 15:19:50-08:00
File Access Date/Time : 2023:02:15 15:30:07-08:00
File Creation Date/Time : 2023:02:15 15:19:50-08:00
File Permissions : -rw-rw-rw-
File Type : DOC
File Type Extension : doc
MIME Type : application/msword
Identification : Word 8.0
Language Code : English (US)
Doc Flags : 1Table, ExtChar
System : Macintosh
Word 97 : No
Title :
Subject :
Author : {redacted}
Keywords :
Template : Normal.dotm
Last Modified By : {redacted}
Software : Microsoft Macintosh Word
Create Date : 2014:02:14 08:04:00
Modify Date : 2014:02:14 17:42:00
Security : None
Code Page : Mac Roman (Western European)
Company : S&R
Char Count With Spaces : 10650
App Version : 14.0000
Scale Crop : No
Links Up To Date : No
Shared Doc : No
Hyperlinks Changed : No
Title Of Parts :
Heading Pairs : Title, 1
Comp Obj User Type Len : 32
Comp Obj User Type : Microsoft Word 97-2004 Document
Last Printed : 0000:00:00 00:00:00
Revision Number : 4
Total Edit Time : 7.4 hours (Inspector reports this as 07:26:00)
Words : 330
Characters : 10624
Pages : 5
Paragraphs : 304
Lines : 312
Word Preferences report the Last Modified as 2/14/2014 12:42PM and Created 2/14/2014 3:04AM. Word also reports a Last Printed time (obviously wrong) of 12/31/1903 4:00PM while Exiftool is all zeros.
From the case investigation I believe the true creation time was 3:04AM local time in South Africa (GMT+2). The document was emailed to the U.S. later that day but was never modified again.
I can share the Word document with you directly if that will help. Please contact me directly
jberryhill@computerforensics.com
Thanks
Jon
Older versions of ExifTool added a "Z" to the stored date/time values (CreateDate and ModifyDate), but unfortunately Microsoft is inconsistent and sometimes stores local time values, so I had to remove this.
I think things are consistent with what Word displays if you assume the ExifTool-reported times are UTC.
- Phil