Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am a professor and was emailed a Word document (.docx) by a student, which the student claimed to have completed by the deadline (about two months ago) but her partner failed to submit. The student created the document in Microsoft Word 2007. When I open the document in Word 2010, I see:

  • Last Modified: 5/11/2011 4:58 PM
  • Created 5/11/2011 4:21 PM

When I asked the student about the discrepancy, she couldn't explain it, except to say that she had copied the file from one place to another and had renamed it. Could either of these change the Word properties?

share|improve this question
up vote 2 down vote accepted

I took a document that I created back in November 2010. In Windows Explorer the file properties show:

  • Created: November 23, 2010, 11:45:20 AM
  • Modified: November 23, 2010, 7:58:40 PM

So we know this file was created and modified then. I opened it in Word 2007 and displayed the properties. This showed the same dates. This shows that the Word properties are the same as the file properties (just in case Word is doing something odd with dates).

I then copied the document and renamed it. In Windows Explorer the file properties show:

  • Created: May 16, 2011, 10:38:57 PM
  • Modified: November 23, 2010, 7:58:40 PM

Copying a file changes the creation date. It's the date the copy was created. It doesn't change the modification date. So, if the student just copied and renamed the document, it should have had the original modification date.

However, the student may have made the copy by opening the file and saving it with another name. I did that and my new file has these dates.

  • Created: May 16, 2011, 10:42:47 PM
  • Modified: May 16, 2011, 10:42:47 PM

Note that these dates are the same. This is a new file as far as the file system is concerned, so both the dates are today's date.

Finally I opened the file, made a change, and saved it. This resulted in these dates.

  • Created: May 16, 2011, 10:42:47 PM
  • Modified: May 16, 2011, 10:46:15 PM

This shows that the file was created on May 11, 2011 at 4:21 PM, and modified about 37 minutes later. Giving the student the fullest benefit of the doubt, she could have created a copy of the document. She would then have to make a change and save it again about 37 minutes later. It's plausible this was done innocently while proofing the document.

It's also possible that the document was started on May 11, 2011 at any time prior to 4:21 PM, first saved at 4:21 PM, and that additional changes were made and it was saved again at 4:58 PM.

If the document was indeed copied from another document, then you can ask the student for that document. It should have the original dates on it.

Finally, it's easy to fake the dates by changing the PC clock.

share|improve this answer
Thank you very much. FWIW, the student's claim is that she backed up the file and then restored it. – espertus May 17 '11 at 10:40

I recently dealt with a similar problem myself. I believe that the most accurate way to determine when a docx file was created is to look in the XML files themselves. You can do this by renaming the file, e.g. example.docx, to and then opening it with any program that can handle zip files. In the docProps folder, look for a file named core.xml. You can open this file with any text editor such as notepad. Look for a section in the file that looks like this:

<dcterms:created xsi:type="dcterms:W3CDTF">2011-05-20T19:56:00Z</dcterms:created>

This gives the date and time of file creation in UTC, and I believe it is set when a file is first created.

share|improve this answer

Here is what I would do to fake a date in Microsoft Word 2007+ document. Steps from a linux shell:

$ mkdir dummy && cd dummy
$ unzip /path/to/input.docx 
$ ls -al docProps/core.xml
-rwxrwxrwx. 1 root root 784 Jan  1  1980 docProps/core.xml
$ vim docProps/core.xml
[change the date in the XML element "created" and "modified" as you wish]
$ touch -d 19800101 docProps/core.xml
$ ls -al docProps/core.xml
-rwxrwxrwx. 1 root root 784 Jan  1  1980 docProps/core.xml
$ zip -r -X /path/to/input_edited.docx *

Enjoy !

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .