Faked Last Modified Date - can I prove it?

[viennedemina]

Someone has sent me an Excel file with a last modified date that I think is too early. I think it has somehow been faked.

Can this be done? Maybe by changing the clock on the PC when accessing and modifying the file?

It is really important to prove this if I can but I can't think how I possibly can.

Any thoughts?

 

[DelJo63]

OH YEAH. Question is what is the motivation to do so? Changing the PC clock is not necessary as there are library routines to manipulate Create Time, Modification Time and Last Access Time.

If the Modification time comes BEFORE Create time, then it has been manipulated, but anyone attempting this should know how to set both.

You can see ALL three timestamps; Right click on the file ->properties. On the General Tab all three are shown.

 

[viennedemina]

OH YEAH. Question is what is the motivation to do so? Changing the PC clock is not necessary as there are library routines to manipulate Create Time, Modification Time and Last Access Time.

If the Modification time comes BEFORE Create time, then it has been manipulated, but anyone attempting this should know how to set both.

You can see ALL three timestamps; Right click on the file ->properties. On the General Tab all three are shown.

Thanks

The modified date does not pre-date the created date but I still suspect foul play. If a library routine was used could that be detected? Likewise changing the PC clock?

 

[DelJo63]

Thanks
The modified date does not pre-date the created date

I noted this as an obvious tell-tail, but the MOD file can be set arbitrarily.

but I still suspect foul play.

WHY?

If a library routine was used could that be detected? Likewise changing the PC clock?

if modified, there are no 'finger prints' to determine HOW it was done.

 

[viennedemina]

if modified, there are no 'finger prints' to determine HOW it was done.

So I'm stuffed, no way of proving or disproving what I think?

WHY?

instinct / something does not add up / I know them!

 

[DelJo63]

So I'm stuffed, no way of proving or disproving what I think?

correct.

 

[viennedemina]

correct.

Ah well. Thanks for your help, though!

 

[Cycloid Torus]

Wondering if the potential for modification means that the worksheet cannot be relied on as a 'witness'. Difficult to express that without seeming to denigrate the source, but the fact that it could be so modified means it cannot be relied upon.

I remember a patent attorney instructing that the inventor should keep a hand written ink journal in a bound book of pre-numbered pages (important that no pages are removed or replaced).

 

[DelJo63]

It can be verified before being distributed by 'Signing' the document, say with a PGP product. Once so signed, any alteration would invalidate the signature, creating a legal proof.

However, docs such as Excel, are frequently intended to be modified and the above technique goes out the window.