Faked Last Modified Date - can I prove it?

By viennedemina ยท 8 replies
Sep 8, 2017
Post New Reply
  1. Someone has sent me an Excel file with a last modified date that I think is too early. I think it has somehow been faked.

    Can this be done? Maybe by changing the clock on the PC when accessing and modifying the file?

    It is really important to prove this if I can but I can't think how I possibly can.

    Any thoughts?
  2. jobeard

    jobeard TS Ambassador Posts: 11,791   +1,252

    OH YEAH. Question is what is the motivation to do so? Changing the PC clock is not necessary as there are library routines to manipulate Create Time, Modification Time and Last Access Time.

    If the Modification time comes BEFORE Create time, then it has been manipulated, but anyone attempting this should know how to set both.

    You can see ALL three timestamps; Right click on the file ->properties. On the General Tab all three are shown.
  3. viennedemina

    viennedemina TS Rookie Topic Starter


    The modified date does not pre-date the created date but I still suspect foul play. If a library routine was used could that be detected? Likewise changing the PC clock?
  4. jobeard

    jobeard TS Ambassador Posts: 11,791   +1,252

    I noted this as an obvious tell-tail, but the MOD file can be set arbitrarily.
    if modified, there are no 'finger prints' to determine HOW it was done.
  5. viennedemina

    viennedemina TS Rookie Topic Starter

    So I'm stuffed, no way of proving or disproving what I think?

    instinct / something does not add up / I know them!
  6. jobeard

    jobeard TS Ambassador Posts: 11,791   +1,252

  7. viennedemina

    viennedemina TS Rookie Topic Starter

    Ah well. Thanks for your help, though!
  8. Cycloid Torus

    Cycloid Torus Stone age computing. Posts: 3,396   +857

    Wondering if the potential for modification means that the worksheet cannot be relied on as a 'witness'. Difficult to express that without seeming to denigrate the source, but the fact that it could be so modified means it cannot be relied upon.

    I remember a patent attorney instructing that the inventor should keep a hand written ink journal in a bound book of pre-numbered pages (important that no pages are removed or replaced).
  9. jobeard

    jobeard TS Ambassador Posts: 11,791   +1,252

    It can be verified before being distributed by 'Signing' the document, say with a PGP product. Once so signed, any alteration would invalidate the signature, creating a legal proof.

    However, docs such as Excel, are frequently intended to be modified and the above technique goes out the window.

Add your comment to this article

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...