up vote 2 down vote favorite
share [g+] share [fb]

I need to be pointed in roughly the right direction of where to look.

Basically we need to be able to determine exactly when a file (a word document) was originally created (not the "created on" date as it's an email attachment), exactly when the file was modified and the date it was last printed (I believe Word stores this information) etc. We can see some of this information ourselves but it needs to be independently verified. We need this done by someone who is a professional at such things and based in the UK.

We need this in light of possible legal proceedings (not against us) so they must be an impartial organisation/individual. We need this verified before we can go any further.

I don't know whether this is the right place to post this but I don't really know where to start looking for people/an organistion that do this.

Ok hope that makes sense to someone out there.

link|improve this question
feedback

2 Answers

up vote 2 down vote accepted

I'm not a layer and this is NOT legal advice

Any digital document you have can be altered to say whatever you want it to say (metadata or content). So anything such an expert may say can (should?) be challenged.

If the other party hands over a (another) copy of the file (and it's integrity in transit to a 3:d party is verified by some legal measure) and the file is identical to your file (byte-by-byte) then any findings (by said 3:d party) about creation dates and whatnot may have value in a legal situation.

Digital data integrity verification is a bi**h if it's not digitally signed.

link|improve this answer
I wouldn't have said any better! – r0ca Aug 19 '10 at 18:34
@r0ca -- thanks – Nifle Aug 19 '10 at 21:32
Thanks a lot and sorry for the late response. I am aware that any of that information can be altered and I also agree that any "expert" we get to look at it should be challenged. However I still need to be pointed in the right direction for what kind of individual/organisation we should be looking at for this kind of task. Some more background: we are trying to show that another organisation has been lying about when/if they've contacted us and we're looking into all possible means to do so. Thanks again for your response and anything further you can add is much appreciated. – user46792 Aug 24 '10 at 10:55
@pmells - If you want to proceed you probably want to talk to a layer and a private investigator with computer forensics experience. – Nifle Aug 24 '10 at 21:32
Yes, we have approached the solicitor but I wasn't sure whether it was a private investigator we needed or some industry specialist. Thanks for your answers. – user46792 Aug 25 '10 at 13:19
feedback
up vote -2 down vote

If it's a Word document, the original creation date is stored within the file itself. You can see the information by right-clicking the file and choosing "Properties." On the "Details" tab you see information like:

alt text

The "Content Created" field is the original creation date of the file. In my example above, I've copied, renamed, and moved this file many times but its original creation date is fixed. There are some other useful stats there as well. All of this information is stored inside the document.

When you scroll down you'll see:

alt text

These statistics refer to this particular physical file, according to the Windows file system. This information is stored outside the file.

Finally, it is possible to have Word or Windows remove all of this data but it's something you must consciously do.

link|improve this answer
For independent verification, and particularly if it's going to play a role in a legal proceeding, you should work with your legal counsel and he or she should arrange for the independent forensic examination. I would imagine that the individual providing such evidence would, at the very least, need to attest to its accuracy under oath. – BillP3rd Aug 19 '10 at 18:10
-1. I think you misunderstood the question. The deal is to ensure that the information is correct "in light of possible legal proceedings". Any file property or property saved by Microsoft Word can be changed, so cannot be a legal proof. – MainMa Aug 19 '10 at 18:11
Which is why I followed immediately with the comment above about involving legal counsel to obtain independent forensic examination. I provided the information in my answer so they, themselves could see the information. – BillP3rd Aug 19 '10 at 18:26
Thanks for your answer Bill, we had already looked at that information and the answer was closer met in your immediate follow up. – user46792 Aug 24 '10 at 10:56
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.