Explanation of Summary Metadata

[Guest]

I am a computer forensic agent with DHS. I retrieved a word doc (Word 2003)
from a suspect computer. I right-clicked on the file and clicked PROPERTIES
-> SUMMARY TAB -> ADVANCED. In the ORIGIN section it shows the Date Created
and Date Last Saved as 4/18/2003. However, I know that the file was actually
written on January 29, 2006 and the General tab reflects that. Where does the
ORIGIN data come from? I am guessing that is may come from the date when the
Normal Template was created, but I need a more defninative answer.

Thank you for your help.
Joe
Baltimroe, MD

 

[Guest]

An e-published Microsoft support article
identifies the following as examples of
metadata categories a typical MS Word
document may contain:
• Author’s name
• Author’s initials
• Author’s company or organization
name
• The name of Author’s computer
• The name of the network server or
hard disk where Author saved the
document
• Other file properties and summary
information
• Non-visible portions of embedded
OLE objects
• The names of previous document authors
• Document revisions
• Document versions
• Template information
• Hidden text
• Comments to document.12

 

[Guest]

You might want to look at this explanatory article:

http://www.sah.com/documents/attorneys/769_20041004_colorado_lawyer.pdf