How can a Word document attached to en email have a modification date later then the send date? (Court case)

A possible answer is that on the computer where the email originated, the system clock was set incorrectly to the June 28 date when the document was modified and saved. The real date could have been any time between January 2 and February 10. That date setting could have been intentional (through the Date and Time dialog in the Windows Control Panel) or a malfunction.

Because of things like this, the dates saved in computer files are not reliable as legal or forensic evidence.

Thank you, but that cannot be the case. I'm sure that the computer from which it was sent had the correct date/time when it was send. In the same time zone. So I repeat my question: How can it be possible that the Modification date of an attachement is later then the date that the message was sent?

The dates associated with any electronically stored document are so easily changed, that (as Jay suggested) without corroboration such a document has little if any evidential value. If the case revolves around this particular electronic document alone without such corroboration then you are going to struggle, and it doesn't matter whether it was attached to an e-mail message or sent in a zip file..

The attachment files are actually created on the target system on the day they are saved to the local HDD: this is what happens when you open attachments in Word, even if they are open as temporary files. This defines the date associated with the open/saved attachment file(s). This is by design, you cannot help it.

This said, the original creation/modify/access dates of the original file(s) can still be preserved if they are sent within a compressed archive file (ZIP). In other words, ask the original sender to resend the document within a compressed archive file (ZIP file). You can then save the ZIP attachment to your HDD, and extract the original file which will retain its original creation/modify/access dates.

HTH.

Cheers,

Robert

Ok, I understand the first paragraph. And the details window shows indeed the date of today when it was "last accessed" (it doesn't give a save date as such).

I also understand the second paragraph, more or less, and I will try to get the file into a ZIP file.

But it still doesn't explain why the "Modification date" shows a date in June. How can that happen?

The dates associated with any electronically stored document are so easily changed, that (as Jay suggested) without corroboration such a document has little if any evidential value. If the case revolves around this particular electronic document alone without such corroboration then you are going to struggle, and it doesn't matter whether it was attached to an e-mail message or sent in a zip file..

Thank you for your reply. Well, to be honest, even the attached document with these "strange dates" will not help them in their case, because I have other ways to prove that what's in that document doesn't correspond with certain dates. However, it would have been nice if I could bring up a plausible scientific IT explanation why the modification date is later than the send date.

Thank you

I have made a little progress myself. When I look at the file details of the attachement it states :

C:\Users\Timo\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\EJWY323M

Created : 28 June 2012

Modified : 28 June 2012

So this explains somehow the date 28 June 2012. At that date, the attachement was somehow saved in a cache somewhere. I tried navigating to that file on my disk but I can browse until the InNetCache directory, but than, within that directory I don't see any subdirectories (like the Content.Outlook directory). Only files. And not the EJWY323M file. I tried searching for the EJWY323M file in the \Local\Microsoft\Windows sub directory (and lower) but nothing found. I have enabled the showing of all hidden and system files and directories. So where can I find that file???