Solved

Inconsistency with the Microsoft Word metadata – Total edit time

Posted on 2013-02-06
7
2,108 Views
Last Modified: 2013-02-11
We have created an IT Process document and submitted to our HOD. It took us almost two complete days, multiple edits & reviews. Finally when we have given it to my boss, the “Total edit time” shows as only two minutes. Other properties like Author, Reviewer, and Creation Date & Last Modified date were shown normally.

	Two people have worked on the document
	We have used Microsoft Office 2007/2010
	DOCX format was used
	FAT32 formatted USB Stick is used transfer file between edits

Can somebody help me understand what might have gone wrong and how to reproduce it? It is very important for me to prove that we have worked on the document for so many hours.
0
Comment
7 Comments
 
LVL 38

Expert Comment

by:BillDL
ID: 38864911
Hi

I'm not sure I could even begin to answer your question, but can I suggest that you add the "Digital Forensics" zone (http://www.experts-exchange.com/Security/Digital_Forensics) to the topics for your question.  The experts there deal with this type of thing on a daily basis and your question will get more exposure by adding it to that topic.

Bill
0
 
LVL 78

Expert Comment

by:David Johnson, CD, MVP
ID: 38866148
FAT32 formatted USB Stick is used transfer file between edits  Use an NTFS formatted USB stick if you need to preserve the metadata
0
 
LVL 61

Assisted Solution

by:btan
btan earned 250 total points
ID: 38870572
This may be useful.

extract metadata - http://computer-forensics.sans.org/blog/2009/07/10/office-2007-metadata/

Rename the extension by changing the ".docx" to a “.zip” extension.  After you rename the extension, double click on it and this will open it in Windows Explorer (or your default Zip application) and will display the Word document as XML and at the root level of the XML file.

Look out for docProps/core.xml and docProps/app.xml. These files contain the actual metadata information, such as document creator, last saved by information, etc.

info on metadata -
http://msdn.microsoft.com/en-us/library/office/bb266220(v=office.12).aspx

If it is saved in ntfs drive, info on the timestamp will be captured which can be useful. not so much of integrity of file but minimally timestamp tampering may be detected if there is use of timestomp etc. See this on $I30

http://computer-forensics.sans.org/blog/2011/09/20/ntfs-i30-index-attributes-evidence-of-deleted-and-overwritten-files
0
6 Surprising Benefits of Threat Intelligence

All sorts of threat intelligence is available on the web. Intelligence you can learn from, and use to anticipate and prepare for future attacks.

 
LVL 38

Accepted Solution

by:
BillDL earned 250 total points
ID: 38870976
SreenivasreddyRanabothu

It is clear from the links and information that breadtan provided, and from what I already knew, that the \docProps\app.xml file in the .docx package contains the tag:
<TotalTime>x</TotalTime>
where the "x" value will be the cumulative editing time in minutes for that document.

Here is what I understand of the way MS Word writes and stores this value:

1. When the document is opened the clock starts ticking, but the value is not written to the document until the file is saved.

2. While the "Save As" function retains some of the metadata in the new document, the editing time is set back to zero in that document.  This would not be the case if contents were copied from one document to a new one, where metadata from the original would be lost.

3. The clock keeps ticking while that document is opened and is the active window.  In older versions of Word (I think 2003 and older) the edit time is still incremented even if the open Word document window is inactive.

4. The editing time is affected by the system clock on any computer that opens the document and saves it again.

5. The time tracking feature can be disabled by a simple registry hack, and in some European countries where the governments have decided that time tracking is not legal, this is done as a matter of course.  xx.0 below replaces the Office version, eg. 12, 14
[HKEY_CURRENT_USER\Software\Microsoft\Office\xx.0\Common\General]
New 32-bit DWORD named "NoTrack" set to a value of 1
There may be other influences on this such as Windows regional settings and Office language settings:
http://www.scribd.com/doc/55390264/Get-Total-Editing-Time-to-Work-in-Word-2010

6. The total editing time value should not be modified by copying or moving a docx file between different computers and differently formatted storage media, because it is stored in the XML files that are inside the docx document package.

because of the possible causes of inconsistency with this value, I really don't think that the "Total Editing Time" value stored by MS Word is an accurate enough reflection of actual editing time involved to be the basis of invoicing, employee performance monitoring, or anything else like that.

As an example, I used to run the despatch department of an engineering company quite a number of years ago.  I had taken over from somebody who had very few details documented and anything that was written down had been scribbled into in a non-indexed old book.  I created a Word document (probably Word 97) and left it open all day and every day adding details to it, such as addresses, customs commodity codes, import/export restrictions, and other details pertinent to the department I was running.  The idea was to have an alphabetic index of customer names with clickable links instead of having to look up a scrappy old book or start telephoning different places to get details.

The manager, who was reasonably IT literate and had seen the document on my terminal, looked at the "Total Editing Time" and must have got the impression that I had been working on it for hours instead of doing other work.  He asked me about it and I explained that my actual editing time probably only amounted to about 10 minutes each day at different intervals as I came across the info for each customer.  The IT Manager supported my explanation by informing the manager that the value was only a reflection of how long the document had been open that day before being saved.

Here is a long discussion that exemplifies the inconsistencies of date stamps and other metadata when it comes to proof:

http://ask.metafilter.com/208880/Help-with-Microsoft-Word-doc-properties

What I am not absolutely sure about is the incremental autosave feature of Word, and how that affects the editing time value.

There are a lot of potential variables involved here, but hopefully breadtan has given you the means to figure out where this value might have been getting modified.
0
 

Author Closing Comment

by:SreenivasreddyRanabothu
ID: 38874948
We could get the insight required to get the details required. Thank you very much for wonderful information.
0
 
LVL 38

Expert Comment

by:BillDL
ID: 38876656
Thank you SreenivasreddyRanabothu
0

Featured Post

How to run any project with ease

Manage projects of all sizes how you want. Great for personal to-do lists, project milestones, team priorities and launch plans.
- Combine task lists, docs, spreadsheets, and chat in one
- View and edit from mobile/offline
- Cut down on emails

Join & Write a Comment

My experience with Windows 10 over a one year period and suggestions for smooth operation
Outlook Free & Paid Tools
This video shows and describes the main difference between both orientations in Microsoft Word. Viewers will understand when to use each orientation and how to get the most out of them.
The viewer will learn how to make their project stand out over others by learning how to change colors and shapes, add spaces, change directions, and add bullets to their charts.

757 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

21 Experts available now in Live!

Get 1:1 Help Now