Embedded file access datetime from XLS

[kieranjol]

It appears that when you open an XLS file in Excel, a MS FILETIME value  gets updated in the file itself, but this value isn't detected by any tool that I know of. I only figured this out because I noticed that the md5 checksum of XLS files were changing after opening them, and then I found the hex values which were changing. Richard Lehane (author of Siegfried) realised that it was MS FILETIME value, which he demonstrated using this code: https://go.dev/play/p/WhEa4ALfwFP
with some more context here:
https://twitter.com/richardlehane/status/1498288921968615435

I'm not sure that this value should be called in Exiftool, as I can't find any info in the XLS spec to figure this out, and Exiftool currently calls File Access Date/Time is when Exiftool runs on the file.

I've attached an example file, where the relevant bytes are in offset 626c-6273, and the hex value is B0 C1 4A D8 AA 2C D8 01 which Richard's Go code translates as 2022-02-28 13:06:54 +0000 UTC
Running Windows 10, with the Windows exe v 12.40.
Best,

Kieran O'Leary
National Library of Ireland

[StarGeek]

and Exiftool currently calls File Access Date/Time is when Exiftool runs on the file.

This is the FileAccessDate, which is one of the time stamps of the underlying file system, not embedded in the file.  It is the "Accessed" value when you view the properties of the file.  This would change whenever the file is read, but would not changed the md5 checksum of the file.

[kieranjol]

I understand what you're referring to, but if you look at my post, this is specific to XLS and it is actually embedded. I attached a file and showed the byte offset, and the hex value that shows the date value. Every time that an XLS file is opened in Excel (I tested on the latest version of Excel on Mac, and Windows Excel 2016), this value is updated in the file itself, not just file system metadata, which resulted in a new checksum.

[kieranjol]

Also, Tim Allison from Apache Tika confirms that their tools can extract this value: https://twitter.com/_tallison/status/1498314479125229568?cxt=HHwWgMCroZLFisspAAAA and he confirms the diff between an original file and the changed value when you open the XLS file.

[StarGeek]

this is specific to XLS and it is actually embedded.

I understand this.  I was clarifying the part of the post I quoted.

It'll be up to Phil to look at the file in more detail to see if it's something that can be added to exiftool.

[Phil Harvey]

The value you mention is in the mini-FAT.  Interesting.  I'll have to look at this in more detail, but it could be that each entry in the mini-FAT has a timestamp.  ExifTool is not extracting these.

- Phil

[kieranjol]

Thank you for looking into this!

[kieranjol]

Richard Lehane linked to this on twitter and it's a very thorough analysis of the value: https://df-stream.com/2013/07/ms-excel-and-ole-metadata-last-opened/