Comparison of dates shown in Windows Explorer and metadata
Windows Explorer v Metadata
There are one basic date shown by default in Windows Explorer: Date Modified. However, that is not necessarily the date when a file has been modified!
For example, when a file is downloaded, the Date Modified of that file becomes the date (and time) it was downloaded. Therefore, a file which has not been modified for years can suddenly be shown as having been recently modified, even though it hasn’t.
This is also true if a file is dragged out of Microsoft Outlook or for photographs. The Date Modified becomes the date when the dragging operation was performed. (For this reason, if you are extracting attachments out of an email, it is better to go to File – Save Attachments instead of dragging them into Windows Explorer). For more information, see this article about incorrect photo dates.
Additionally, regardless of how they are saved, not only emails saved or dragged into Windows Explorer lose the correct modified date, most of its metadata is inaccessible in Windows.
However, because the files are not modified, the metadata inside the files remains intact. Therefore, a more detailed examination such as that provided by Filecats Professional is able to report more useful date information.
The files in the catalog downloaded on the right were downloaded on 20 October 2014, and Windows Explorer shows that date. Whilst Filecats Professional shows that date as well, it also shows date from the metadata, which confirms that the true date of these files is anywhere from January 1999 to October 2014.
This date can be taken from many different sources:
- For Microsoft Office documents, it will be the Date Last Saved.
- For photographs, it will be the Date Picture Taken (i.e. when the camera believes the photo was taken).
- For emails stored in MSG format, it will be the Client Submit Date.
These dates should generally be used in preference to the Windows Explorer date. However, there are caveats. For example, a date a camera believes a photo was taken is dependent on the camera having been set up correctly. In one case, it was found that a camera’s internal date was 2 years and 2 days out.
This could be established by corroborating evidence, such as a photograph of a newspaper or other location which must have been taken on a certain date. It can also be established if the organiser of the files is very methodical, for example saving photographs in a filing structure according to the date taken (e.g. E:photos2014Jan14).
There are also problems with the Date created date. The files in the catalog downloaded on the right were downloaded on 24 October 2014, and Windows Explorer shows that date. Whilst Filecats Professional shows that date as well, it also shows date from the Microsoft Office metadata, which confirms that the true date that these files were created is anywhere from October 1996 to October 2014.
Other dates are also available, such as Last Printed, which is used for around 50% of all Word documents (according to the article “What metadata are actually used in Word documents”). Time-zone information may also be important; a file may be identical but reporting a different hour of the day, if accessed through a different country.
Result: Windows Explorer 0 – Metadata 2
It is therefore important that, if you are relying on dates being accurate, that you have more than one source of data, and the metadata extractor Filecats Professional is able to extract dates from more than source, thereby either confirming the dates, or maybe allowing you to investigate more deeply.
Was this article useful to you? If so, please click the “Like” or “Tweet” buttons to the left-hand side of this page.
