I am a computer forensic agent with DHS. I retrieved a word doc (Word 2003)
from a suspect computer. I right-clicked on the file and clicked PROPERTIES
- SUMMARY TAB - ADVANCED. In the ORIGIN section it shows the Date Created
and Date Last Saved as 4/18/2003. However, I know that the file was actually
written on January 29, 2006 and the General tab reflects that. Where does the
ORIGIN data come from? I am guessing that is may come from the date when the
Normal Template was created, but I need a more defninative answer.

Thank you for your help.
Joe
Baltimroe, MD

An e-published Microsoft support article
identifies the following as examples of
metadata categories a typical MS Word
document may contain:
€¢ Authors name
€¢ Authors initials
€¢ Authors company or organization
name
€¢ The name of Authors computer
€¢ The name of the network server or
hard disk where Author saved the
document
€¢ Other file properties and summary
information
€¢ Non-visible portions of embedded
OLE objects
€¢ The names of previous document authors
€¢ Document revisions
€¢ Document versions
€¢ Template information
€¢ Hidden text
€¢ Comments to document.12

"DHSMan" wrote:

I am a computer forensic agent with DHS. I retrieved a word doc (Word 2003)
from a suspect computer. I right-clicked on the file and clicked PROPERTIES
- SUMMARY TAB - ADVANCED. In the ORIGIN section it shows the Date Created
and Date Last Saved as 4/18/2003. However, I know that the file was actually
written on January 29, 2006 and the General tab reflects that. Where does the
ORIGIN data come from? I am guessing that is may come from the date when the
Normal Template was created, but I need a more defninative answer.

Thank you for your help.
Joe
Baltimroe, MD

You might want to look at this explanatory article:

http://www.sah.com/documents/attorne...ado_lawyer.pdf

"Carol" wrote:

An e-published Microsoft support article
identifies the following as examples of
metadata categories a typical MS Word
document may contain:
€¢ Authors name
€¢ Authors initials
€¢ Authors company or organization
name
€¢ The name of Authors computer
€¢ The name of the network server or
hard disk where Author saved the
document
€¢ Other file properties and summary
information
€¢ Non-visible portions of embedded
OLE objects
€¢ The names of previous document authors
€¢ Document revisions
€¢ Document versions
€¢ Template information
€¢ Hidden text
€¢ Comments to document.12

"DHSMan" wrote:

I am a computer forensic agent with DHS. I retrieved a word doc (Word 2003)
from a suspect computer. I right-clicked on the file and clicked PROPERTIES
- SUMMARY TAB - ADVANCED. In the ORIGIN section it shows the Date Created
and Date Last Saved as 4/18/2003. However, I know that the file was actually
written on January 29, 2006 and the General tab reflects that. Where does the
ORIGIN data come from? I am guessing that is may come from the date when the
Normal Template was created, but I need a more defninative answer.

Thank you for your help.
Joe
Baltimroe, MD