I have two Word 2016 .doc files I'm looking into the metadata of. We'll call them Doe.doc and Doe Sep 20xx.doc.
Exiftool 12.48 reports for Doe.doc:
File Modification Date/Time : 2018:09:16 17:12:56-07:00
When you right click this file->Properties, General tab it shows
Modified: Sunday, September 16, 2018: 5:12:54.
That is, 2 seconds before than what exiftool shows. I've also confirmed that exiftool gets same result by seeing that Forensic Explorer 5.4.8 and Xways 20.0 both report :56 seconds.
On another document in this case, same thing- MS Properties shows 2 seconds behind what exif and other tools report. I expect if they were off, they'd be way off. (unless it's the 3 other tools that are wrong, but that seems unlikely).
I also note this is one of many issues with Windows displaying its own data (for instance, when you try and find file size of a folder sometimes it's massively off...)...
Anyone seen this before, and any explanation that makes sense?
I can't replicate it here, checking several doc files.
What file system are these files on? Is it, for example, a flash drive formatted as FAT32?
Ok, so the interesting thing is when I right click->properties->General tab on my Win 10 Enterprise LTSC system, the modified time shows correct. However the screenshots of these files taken when they were on a Win 7 Enterprise system are the ones that show xx:xx:-02 seconds behind the other tools. So it may have been a Win 7 issue? I do recall Win 7 on my old system being notoriously terrible at telling me properties of files (sometimes trying to find file size by right clicking a folder would be extremely off, had to use other tools to tell me file size). And to be clear, these files are definitely .doc and not .docx that I'm looking into. Thanks for checking!
Windows has inconsistent handling of time zones, and you never see an odd number of seconds, but this offset of 2 seconds is new to me.
- Phil
I no longer have access to the Win 7 Enterprise machine, I wonder if anyone here does and can test it (might even do it on regular Win 7). These docs are related however were stored on different drives (one local C: NTFS drive, one shared network drive unk filesystem) and both had the weird -2 seconds for modified time.