Hi! I've been asked to explain how Word updates the "Statistics" tab in the
Properties parameter. Specifically, they want to know how/when the users and
date/time stamps are determined for each of the categories ... created,
modified, accessed and printed. Is there any way of knowing (without
programming ... we're looking at current/historical documents, not new
documents) who did what and when?

Thanks!

Cindy

Hi Cindy:

There is no way of knowing "who" did something to a Word document, beyond
the "Last saved by" field, which will give you the user login ID of the user
who last saved the document.

The Date/Time stamps in the Statistics tab come from Word. The times in the
General tab come from the operating system. Each Date/Time is in Windows
Date/Time format: a 32-bit number, a Julian date recording elapsed time from
00:00:00 on Jan 1, 1601.

The Created time is copied from the source: so it can be the date the
template was created, or the time the document was created that the current
document was copied from.

The Printed time is also copied, so it is the last time that the document or
the document it was copied from was sent to print.

Modified is the last save time, Accessed is the last "opened" time.

Even if you "did" do quite a lot of programming, you would be unlikely to
get any further "reliable" information than this. If the document's
metadata is intact, you can retrieve details of the previous five or ten
users. If you have the network login names and the Word user details were
correct this may help. However, the Metadata Removal Tool released in
February 2004 should have been used on most documents by now, and will
reliably remove the information you are looking for.

Hope this helps

On 25/2/06 3:51 AM, in article
187B0235-CD1D-4789-840E-(E-Mail Removed), "ckrogers"
<(E-Mail Removed)> wrote:

> Hi! I've been asked to explain how Word updates the "Statistics" tab in the
> Properties parameter. Specifically, they want to know how/when the users and
> date/time stamps are determined for each of the categories ... created,
> modified, accessed and printed. Is there any way of knowing (without
> programming ... we're looking at current/historical documents, not new
> documents) who did what and when?
>
> Thanks!
>
> Cindy

--

Please reply to the newsgroup to maintain the thread. Please do not email
me unless I ask you to.

John McGhie <(E-Mail Removed)>
Microsoft MVP, Word and Word for Macintosh. Consultant Technical Writer
Sydney, Australia +61 (0) 4 1209 1410

It does, John ... thanks!

Basically, that's what I had already told them. They were trying to figure
out if they could use the info for a court proceeding and I told them I had
seen lots of articles on the web on how to get rid of metadata and I didn't
think whatever they could see would be considered "definitive" or "reliable".

Thanks again!

Cindy

"John McGhie [MVP - Word and Word Macinto" wrote:

> Hi Cindy:
>
> There is no way of knowing "who" did something to a Word document, beyond
> the "Last saved by" field, which will give you the user login ID of the user
> who last saved the document.
>
> The Date/Time stamps in the Statistics tab come from Word. The times in the
> General tab come from the operating system. Each Date/Time is in Windows
> Date/Time format: a 32-bit number, a Julian date recording elapsed time from
> 00:00:00 on Jan 1, 1601.
>
> The Created time is copied from the source: so it can be the date the
> template was created, or the time the document was created that the current
> document was copied from.
>
> The Printed time is also copied, so it is the last time that the document or
> the document it was copied from was sent to print.
>
> Modified is the last save time, Accessed is the last "opened" time.
>
> Even if you "did" do quite a lot of programming, you would be unlikely to
> get any further "reliable" information than this. If the document's
> metadata is intact, you can retrieve details of the previous five or ten
> users. If you have the network login names and the Word user details were
> correct this may help. However, the Metadata Removal Tool released in
> February 2004 should have been used on most documents by now, and will
> reliably remove the information you are looking for.
>
> Hope this helps
>
> On 25/2/06 3:51 AM, in article
> 187B0235-CD1D-4789-840E-(E-Mail Removed), "ckrogers"
> <(E-Mail Removed)> wrote:
>
> > Hi! I've been asked to explain how Word updates the "Statistics" tab in the
> > Properties parameter. Specifically, they want to know how/when the users and
> > date/time stamps are determined for each of the categories ... created,
> > modified, accessed and printed. Is there any way of knowing (without
> > programming ... we're looking at current/historical documents, not new
> > documents) who did what and when?
> >
> > Thanks!
> >
> > Cindy
>
> --
>
> Please reply to the newsgroup to maintain the thread. Please do not email
> me unless I ask you to.
>
> John McGhie <(E-Mail Removed)>
> Microsoft MVP, Word and Word for Macintosh. Consultant Technical Writer
> Sydney, Australia +61 (0) 4 1209 1410
>
>

That's the one... I knew the answer because I was retained as a consultant
to a similar legal case in Sydney.

The other side was claiming that the dates in specific documents "proved"
that a bad person had altered the dates after a contract was signed.

My evidence was that while this operation is technically feasible, the level
of expertise required to do it well enough so that a person such as me would
not catch them out was so high as to be unavailable in the small country
legal practice involved.

I suggested to the court that the dates were far more likely to have been
affected by the variations in the clock of (non-networked) minimal
computers, the Y2K bug, failing memory batteries, and copies made from
pre-existing documents.

We won :-)

Large legal firms use Document Management Systems that guarantee the
accuracy of their dates!

Hope this helps


On 13/3/06 3:36 PM, in article
A76A2A24-583D-457E-985D-(E-Mail Removed), "ckrogers"
<(E-Mail Removed)> wrote:

> It does, John ... thanks!
>
> Basically, that's what I had already told them. They were trying to figure
> out if they could use the info for a court proceeding and I told them I had
> seen lots of articles on the web on how to get rid of metadata and I didn't
> think whatever they could see would be considered "definitive" or "reliable".
>
> Thanks again!
>
> Cindy
>
> "John McGhie [MVP - Word and Word Macinto" wrote:
>
>> Hi Cindy:
>>
>> There is no way of knowing "who" did something to a Word document, beyond
>> the "Last saved by" field, which will give you the user login ID of the user
>> who last saved the document.
>>
>> The Date/Time stamps in the Statistics tab come from Word. The times in the
>> General tab come from the operating system. Each Date/Time is in Windows
>> Date/Time format: a 32-bit number, a Julian date recording elapsed time from
>> 00:00:00 on Jan 1, 1601.
>>
>> The Created time is copied from the source: so it can be the date the
>> template was created, or the time the document was created that the current
>> document was copied from.
>>
>> The Printed time is also copied, so it is the last time that the document or
>> the document it was copied from was sent to print.
>>
>> Modified is the last save time, Accessed is the last "opened" time.
>>
>> Even if you "did" do quite a lot of programming, you would be unlikely to
>> get any further "reliable" information than this. If the document's
>> metadata is intact, you can retrieve details of the previous five or ten
>> users. If you have the network login names and the Word user details were
>> correct this may help. However, the Metadata Removal Tool released in
>> February 2004 should have been used on most documents by now, and will
>> reliably remove the information you are looking for.
>>
>> Hope this helps
>>
>> On 25/2/06 3:51 AM, in article
>> 187B0235-CD1D-4789-840E-(E-Mail Removed), "ckrogers"
>> <(E-Mail Removed)> wrote:
>>
>>> Hi! I've been asked to explain how Word updates the "Statistics" tab in the
>>> Properties parameter. Specifically, they want to know how/when the users
>>> and
>>> date/time stamps are determined for each of the categories ... created,
>>> modified, accessed and printed. Is there any way of knowing (without
>>> programming ... we're looking at current/historical documents, not new
>>> documents) who did what and when?
>>>
>>> Thanks!
>>>
>>> Cindy
>>
>> --
>>
>> Please reply to the newsgroup to maintain the thread. Please do not email
>> me unless I ask you to.
>>
>> John McGhie <(E-Mail Removed)>
>> Microsoft MVP, Word and Word for Macintosh. Consultant Technical Writer
>> Sydney, Australia +61 (0) 4 1209 1410
>>
>>

--

Please reply to the newsgroup to maintain the thread. Please do not email
me unless I ask you to.

John McGhie <(E-Mail Removed)>
Microsoft MVP, Word and Word for Macintosh. Consultant Technical Writer
Sydney, Australia +61 (0) 4 1209 1410