Good day,

I need to find a documet that is easy to read and explains the differences
between the Compund File's Summary Stream and the Windows attributes.

I am work a forensic case and have found very strange date/time issues with
some Excel Spread sheets.

When I view the compund file information i have a created on date of
01/01/04 however when I view it in the Windows properties, it gives me a
creation date of 03/05/04. This COULD happen if you created the file on one
computer and 3 months later you copied it to the drive in question, however
the 'Last Revised' date (Attribute in the Summary Stream) and the last
written attrib in Windows do not match. The 'Last Written' is 03/05/04
07:14:25AM but the 'Last Revised' says 03/05/04 9:25:21PM.

I am looking for a document that can shed some light as to how the Compund
Info compares to the File level attributes.

Thanks