Inconsistency with the Microsoft Word metadata – Total edit time

We have created an IT Process document and submitted to our HOD. It took us almost two complete days, multiple edits & reviews. Finally when we have given it to my boss, the “Total edit time” shows as only two minutes. Other properties like Author, Reviewer, and Creation Date & Last Modified date were shown normally.

	Two people have worked on the document
	We have used Microsoft Office 2007/2010
	DOCX format was used
	FAT32 formatted USB Stick is used transfer file between edits

Can somebody help me understand what might have gone wrong and how to reproduce it? It is very important for me to prove that we have worked on the document for so many hours.
Who is Participating?

It is clear from the links and information that breadtan provided, and from what I already knew, that the \docProps\app.xml file in the .docx package contains the tag:
where the "x" value will be the cumulative editing time in minutes for that document.

Here is what I understand of the way MS Word writes and stores this value:

1. When the document is opened the clock starts ticking, but the value is not written to the document until the file is saved.

2. While the "Save As" function retains some of the metadata in the new document, the editing time is set back to zero in that document.  This would not be the case if contents were copied from one document to a new one, where metadata from the original would be lost.

3. The clock keeps ticking while that document is opened and is the active window.  In older versions of Word (I think 2003 and older) the edit time is still incremented even if the open Word document window is inactive.

4. The editing time is affected by the system clock on any computer that opens the document and saves it again.

5. The time tracking feature can be disabled by a simple registry hack, and in some European countries where the governments have decided that time tracking is not legal, this is done as a matter of course.  xx.0 below replaces the Office version, eg. 12, 14
New 32-bit DWORD named "NoTrack" set to a value of 1
There may be other influences on this such as Windows regional settings and Office language settings:

6. The total editing time value should not be modified by copying or moving a docx file between different computers and differently formatted storage media, because it is stored in the XML files that are inside the docx document package.

because of the possible causes of inconsistency with this value, I really don't think that the "Total Editing Time" value stored by MS Word is an accurate enough reflection of actual editing time involved to be the basis of invoicing, employee performance monitoring, or anything else like that.

As an example, I used to run the despatch department of an engineering company quite a number of years ago.  I had taken over from somebody who had very few details documented and anything that was written down had been scribbled into in a non-indexed old book.  I created a Word document (probably Word 97) and left it open all day and every day adding details to it, such as addresses, customs commodity codes, import/export restrictions, and other details pertinent to the department I was running.  The idea was to have an alphabetic index of customer names with clickable links instead of having to look up a scrappy old book or start telephoning different places to get details.

The manager, who was reasonably IT literate and had seen the document on my terminal, looked at the "Total Editing Time" and must have got the impression that I had been working on it for hours instead of doing other work.  He asked me about it and I explained that my actual editing time probably only amounted to about 10 minutes each day at different intervals as I came across the info for each customer.  The IT Manager supported my explanation by informing the manager that the value was only a reflection of how long the document had been open that day before being saved.

Here is a long discussion that exemplifies the inconsistencies of date stamps and other metadata when it comes to proof:

What I am not absolutely sure about is the incremental autosave feature of Word, and how that affects the editing time value.

There are a lot of potential variables involved here, but hopefully breadtan has given you the means to figure out where this value might have been getting modified.

I'm not sure I could even begin to answer your question, but can I suggest that you add the "Digital Forensics" zone ( to the topics for your question.  The experts there deal with this type of thing on a daily basis and your question will get more exposure by adding it to that topic.

David Johnson, CD, MVPOwnerCommented:
FAT32 formatted USB Stick is used transfer file between edits  Use an NTFS formatted USB stick if you need to preserve the metadata
Protect Your Employees from Wi-Fi Threats

As Wi-Fi growth and popularity continues to climb, not everyone understands the risks that come with connecting to public Wi-Fi or even offering Wi-Fi to employees, visitors and guests. Download the resource kit to make sure your safe wherever business takes you!

btanExec ConsultantCommented:
This may be useful.

extract metadata -

Rename the extension by changing the ".docx" to a “.zip” extension.  After you rename the extension, double click on it and this will open it in Windows Explorer (or your default Zip application) and will display the Word document as XML and at the root level of the XML file.

Look out for docProps/core.xml and docProps/app.xml. These files contain the actual metadata information, such as document creator, last saved by information, etc.

info on metadata -

If it is saved in ntfs drive, info on the timestamp will be captured which can be useful. not so much of integrity of file but minimally timestamp tampering may be detected if there is use of timestomp etc. See this on $I30
SreenivasreddyRanabothuAuthor Commented:
We could get the insight required to get the details required. Thank you very much for wonderful information.
Thank you SreenivasreddyRanabothu
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.