Under what circumstances would you possibly find the last printed date to be before the metadata creation date of a Word Document?
Obviously if the local clock was inaccurate for either of these 2 events, but other than that?
Its possible these Word files were created from PDF's - could this account for it?
Can you share some context?
What version of Windows are you looking at? What is the version of Word? Is the document OLE format, or the newer PK/XML format? What are you using to retrieve the data?
Thanks.
The version of Windows is unknown as the files are in isolation. Version 2010 and 2013 of Word were used to create the files using the xml structure file type.
The metadata is visible from the files properties in Windows on my forensic box and is also confirmed by viewing the files in both X-Ways and FTK.
Great, thanks for the response.
Without context, however, it's difficult to do much more than simply provide possibilities and "maybes".
I can replicate that without context.
I created a Word document, printed it, saved it as a template (.dotx). Closed word.
I re-opened Word, created a new document based on the template, saved this as a document (.docx). Closed Word.
The metadata shows the Last Printed 2 minutes before the Created date.
Cool.
PS You dont even have to do templates - if a Word document has already been printed and you SAVE AS to a new file, then the Created timestamp becomes the time you Save As and the Last Printed metadata remains the same (it's not erased/wiped out by the Save As operation).
Move document from drive X to Y, creation date updates for the new drive, printed date stays the same.
Windows API can be used to set any normal filesystem timestamps, can be done with one line of code in .NET.
Under what circumstances would you possibly find the last printed date to be before the metadata creation date of a Word Document?
This can depend on the version of Word.
Some ideas from Corey Harell's posts in this thread http//www.forensicfocus.com/Forums/viewtopic/p=6567921/
One scenario linked from the thread includes
Document Printed then Saved as new document
Thank you very much for your responses. I had thought that a 'save as' with a different name still retained the originating creation date, but no as you state - certainly with Word 2010 it does not.
Thank you.