How to Prove When a File Was Created

What the created, modified and accessed dates mean

Windows and macOS keep three dates for every file. Created is when this copy of the file appeared on this disk. Modified is when its contents last changed. Accessed is when something last opened or read it, and it is the least reliable: Microsoft's documentation on file times notes that NTFS can delay updating the last access time by up to an hour, and many systems switch access tracking off. Windows shows all three under Properties, General; Get Info on a Mac shows Created and Modified.

The same Microsoft page explains that NTFS stores every timestamp in Coordinated Universal Time (UTC) and converts it for display, while the FAT format used on many USB sticks stores local time. Move a file between the two, or change the time zone, and the displayed hour shifts without anyone touching the file.

Filesystem dates versus dates inside the document

The dates above belong to the disk. Many file formats also carry their own dates, written by the application that made them, and these travel with the file when it is copied, so a copy on a reviewer's machine still shows them.

• Office documents. Word, Excel and PowerPoint files store a set of document properties, including the dates when the content was created and last saved, the author name, the last person to save it, the revision number and the total editing time. Microsoft's support page on file properties lists the dates and statistics as automatically updated properties that you cannot edit from inside the app. Find them under File, Info.
• PDFs. A PDF keeps an information dictionary with a creation date, a modification date, and the names of the application that authored the content and the one that produced the PDF. In most PDF readers this is under File, Properties; in Preview on a Mac it is under Tools, Show Inspector.
• Photos. A camera writes EXIF data into each image. The tag that matters is DateTimeOriginal, the moment the shutter fired, listed in the ExifTool tag reference alongside a separate digitised date, a modification date and, since EXIF 2.31 in 2016, a time zone offset. The guide to reading a photo's EXIF data shows where each system displays it.
• Plain text and Markdown. Nothing inside the file; the record comes from version control or backups.

Document dates come from the laptop's clock at the moment of saving, so they are only as good as that clock. A camera set to the wrong year writes the wrong year into every photo.

Why copying and cloud sync change dates

The created date describes the copy rather than the work. When Windows File Explorer copies a file to another drive, the new file is created at that moment, so its Created date becomes the time of the copy while Modified stays as it was. That is why so many files show a creation date later than their modification date, which looks like tampering and is usually nothing of the kind. The Mac Finder generally preserves both dates on a copy; command line copies keep neither unless told to.

Cloud folders behave like a copy on every machine they reach. A document synced to a second laptop arrives as a new file whose Created date is the download time, and clients treat the Modified date differently. The cloud service usually keeps its own activity log with server-side timestamps, and that log is often the strongest evidence you have, because you cannot edit it.

Which timestamp survives which action

Filesystem dates are fragile and describe copies; document dates are portable and describe the work; third-party records are the hardest to alter. Build your case from the right of the table to the left.

Version history and backups as the corroborating record

A timestamp is a single number, and the operating system itself provides a function to change it, so on its own it convinces nobody who knows how files work. What convinces is agreement between records made separately that cannot easily be edited together.

• Version history. Cloud document editors, and word processors saving to cloud storage, record every version with a server-side time. The first entry is a creation date that no file copy can disturb. The draft version history guide explains how to switch this on and how to read it.
• Backup snapshots. File History on Windows and Time Machine on a Mac keep dated copies of your documents folder; Apple's documentation describes hourly, daily and weekly backups, plus hourly local snapshots kept for about a day. A snapshot from three weeks ago containing an early draft shows the draft existed three weeks ago. Read how backups serve as an authorship record for how to find and present one.
• Sent mail and submissions. An email with the file attached carries a server timestamp from a machine you do not control, and so does a submission receipt.

If any of these agree with the document's own created date, the filesystem dates become a footnote. If none exist, start today with the 3-2-1 backup rule.

Assemble a dated record, step by step

1. 01

   Leave the original alone

   Work from the laptop that made the file. Do not email it to yourself, drag it to a USB stick or re-save it first; each of those changes something.

2. 02

   Record the filesystem dates

   On Windows, right-click the file, choose Properties, and screenshot the General tab, then the Details tab for the Origin section. On a Mac, select the file and press Command-I for Get Info.

3. 03

   Read the dates inside the document

   Open the file in the app that made it and note the content created and last saved dates from File, Info, or File, Properties for a PDF. For a photo, note DateTimeOriginal and any time zone offset.

4. 04

   Pull the version history

   Open File, Version history in a cloud editor, or File, Info, Version History in a desktop word processor, and record the date of the earliest version and how many there are.

5. 05

   Find a backup snapshot

   Open File History on Windows or enter Time Machine on a Mac, go to the document's folder, and note the earliest snapshot that contains the file. Restore a copy to a separate folder.

6. 06

   Collect third-party records

   Search sent mail for the filename, check the cloud service's activity panel, and keep any submission receipts, noting the time zone each uses.

7. 07

   Write a one-page timeline

   List every source, the date it gives and where it came from, in order. Where two dates disagree, say why: a copy reset the created date, or a camera clock was an hour out. An explained discrepancy is more credible than a suspiciously tidy record.

Mistakes that undermine an attempt to prove when a file was created

• Sending a copy and expecting the dates to hold. The copy arrives with a new Created date. Send the timeline and screenshots, and offer to show the original on the laptop.
• Trusting the camera clock. Cameras drift and many are never set. Check the camera's current clock against a known time and note the offset.
• Mixing time zones. A cloud log in UTC and a Properties box in local time can differ by hours. Convert everything to one zone.
• Tidying up first. Renaming, moving and deleting drafts destroys the mess that makes a record credible.
• Relying on one timestamp. Every local date can be set by software. Only agreement between independent records carries weight.

This guide is one of the laptop authorship record guides. To prove when a file was created is half the question; the companion guide on checking whether a file has changed since a known copy covers the other half.

This guide is one of the how-to guides for laptop tasks. Once you have a dated record, the next check is whether the file is still the one you finished, which comparing a file against a trusted copy with a hash settles in a minute, and the earliest entry in a document's history is the date that survives every copy, so switching on version history for your drafts is worth doing before the question ever comes up. For the snapshot dates a backup drive adds, see reading the date of a backup snapshot.