Compound File
 

Good day,

I need to find a documet that is easy to read and explains the differences
between the Compund File's Summary Stream and the Windows attributes.

I am work a forensic case and have found very strange date/time issues with
some Excel Spread sheets.

When I view the compund file information i have a created on date of
01/01/04 however when I view it in the Windows properties, it gives me a
creation date of 03/05/04. This COULD happen if you created the file on one
computer and 3 months later you copied it to the drive in question, however
the 'Last Revised' date (Attribute in the Summary Stream) and the last
written attrib in Windows do not match. The 'Last Written' is 03/05/04
07:14:25AM but the 'Last Revised' says 03/05/04 9:25:21PM.

I am looking for a document that can shed some light as to how the Compund
Info compares to the File level attributes.

Thanks

Compound File
 

look into the OLEDOC specification from MS. This specification governs
all extended and custom properties for e.g. Office documents. There is
even an oldedoc viewer with MS Visual Studio.

DM Unseen

Compound File
 

the properties in the Summary Stream are written by the application writing
the file. All applications do not maintain all the properties. A case in
point is the Last Save Time property. In Excel 97, this property was not
maintained. In Excel 2000, Excel began to maintain this property. So a
document could be created in xl97, then used in xl2000 so the property was
assigned a value. then worked with in xl97 where it would remain static and
would not accurately reflect the actual last save time.

Just an example you might find useful.

--
Regards,
Tom Ogilvy

"Mandy Hernandez" wrote in
message ...
Good day,

I need to find a documet that is easy to read and explains the differences
between the Compund File's Summary Stream and the Windows attributes.

I am work a forensic case and have found very strange date/time issues
with
some Excel Spread sheets.

When I view the compund file information i have a created on date of
01/01/04 however when I view it in the Windows properties, it gives me a
creation date of 03/05/04. This COULD happen if you created the file on
one
computer and 3 months later you copied it to the drive in question,
however
the 'Last Revised' date (Attribute in the Summary Stream) and the last
written attrib in Windows do not match. The 'Last Written' is 03/05/04
07:14:25AM but the 'Last Revised' says 03/05/04 9:25:21PM.

I am looking for a document that can shed some light as to how the Compund
Info compares to the File level attributes.

Thanks