Improve company productivity with a Business Account.Sign Up


Inconsistency with the Microsoft Word metadata – Total edit time

Posted on 2013-02-06
Medium Priority
Last Modified: 2013-02-11
We have created an IT Process document and submitted to our HOD. It took us almost two complete days, multiple edits & reviews. Finally when we have given it to my boss, the “Total edit time” shows as only two minutes. Other properties like Author, Reviewer, and Creation Date & Last Modified date were shown normally.

	Two people have worked on the document
	We have used Microsoft Office 2007/2010
	DOCX format was used
	FAT32 formatted USB Stick is used transfer file between edits

Can somebody help me understand what might have gone wrong and how to reproduce it? It is very important for me to prove that we have worked on the document for so many hours.
LVL 39

Expert Comment

ID: 38864911

I'm not sure I could even begin to answer your question, but can I suggest that you add the "Digital Forensics" zone ( to the topics for your question.  The experts there deal with this type of thing on a daily basis and your question will get more exposure by adding it to that topic.

LVL 85

Expert Comment

by:David Johnson, CD, MVP
ID: 38866148
FAT32 formatted USB Stick is used transfer file between edits  Use an NTFS formatted USB stick if you need to preserve the metadata
LVL 66

Assisted Solution

btan earned 1000 total points
ID: 38870572
This may be useful.

extract metadata -

Rename the extension by changing the ".docx" to a “.zip” extension.  After you rename the extension, double click on it and this will open it in Windows Explorer (or your default Zip application) and will display the Word document as XML and at the root level of the XML file.

Look out for docProps/core.xml and docProps/app.xml. These files contain the actual metadata information, such as document creator, last saved by information, etc.

info on metadata -

If it is saved in ntfs drive, info on the timestamp will be captured which can be useful. not so much of integrity of file but minimally timestamp tampering may be detected if there is use of timestomp etc. See this on $I30
Improved Protection from Phishing Attacks

WatchGuard DNSWatch reduces malware infections by detecting and blocking malicious DNS requests, improving your ability to protect employees from phishing attacks. Learn more about our newest service included in Total Security Suite today!

LVL 39

Accepted Solution

BillDL earned 1000 total points
ID: 38870976

It is clear from the links and information that breadtan provided, and from what I already knew, that the \docProps\app.xml file in the .docx package contains the tag:
where the "x" value will be the cumulative editing time in minutes for that document.

Here is what I understand of the way MS Word writes and stores this value:

1. When the document is opened the clock starts ticking, but the value is not written to the document until the file is saved.

2. While the "Save As" function retains some of the metadata in the new document, the editing time is set back to zero in that document.  This would not be the case if contents were copied from one document to a new one, where metadata from the original would be lost.

3. The clock keeps ticking while that document is opened and is the active window.  In older versions of Word (I think 2003 and older) the edit time is still incremented even if the open Word document window is inactive.

4. The editing time is affected by the system clock on any computer that opens the document and saves it again.

5. The time tracking feature can be disabled by a simple registry hack, and in some European countries where the governments have decided that time tracking is not legal, this is done as a matter of course.  xx.0 below replaces the Office version, eg. 12, 14
New 32-bit DWORD named "NoTrack" set to a value of 1
There may be other influences on this such as Windows regional settings and Office language settings:

6. The total editing time value should not be modified by copying or moving a docx file between different computers and differently formatted storage media, because it is stored in the XML files that are inside the docx document package.

because of the possible causes of inconsistency with this value, I really don't think that the "Total Editing Time" value stored by MS Word is an accurate enough reflection of actual editing time involved to be the basis of invoicing, employee performance monitoring, or anything else like that.

As an example, I used to run the despatch department of an engineering company quite a number of years ago.  I had taken over from somebody who had very few details documented and anything that was written down had been scribbled into in a non-indexed old book.  I created a Word document (probably Word 97) and left it open all day and every day adding details to it, such as addresses, customs commodity codes, import/export restrictions, and other details pertinent to the department I was running.  The idea was to have an alphabetic index of customer names with clickable links instead of having to look up a scrappy old book or start telephoning different places to get details.

The manager, who was reasonably IT literate and had seen the document on my terminal, looked at the "Total Editing Time" and must have got the impression that I had been working on it for hours instead of doing other work.  He asked me about it and I explained that my actual editing time probably only amounted to about 10 minutes each day at different intervals as I came across the info for each customer.  The IT Manager supported my explanation by informing the manager that the value was only a reflection of how long the document had been open that day before being saved.

Here is a long discussion that exemplifies the inconsistencies of date stamps and other metadata when it comes to proof:

What I am not absolutely sure about is the incremental autosave feature of Word, and how that affects the editing time value.

There are a lot of potential variables involved here, but hopefully breadtan has given you the means to figure out where this value might have been getting modified.

Author Closing Comment

ID: 38874948
We could get the insight required to get the details required. Thank you very much for wonderful information.
LVL 39

Expert Comment

ID: 38876656
Thank you SreenivasreddyRanabothu

Featured Post

Building an Effective Phishing Protection Program

Join Director of Product Management Todd OBoyle on April 26th as he covers the key elements of a phishing protection program. Whether you’re an old hat at phishing education or considering starting a program -- we'll discuss critical components that should be in any program.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

This tutorial summarizes the causes behind"an unknown error prevented access to the PST File”.  It also suggests the various solutions to fix the problem.
Though there are a few manual ways to import PST files to Office 365 , third-party PST to Office 365 import tools are preferred over them due to various reasons.  Consequently, many tools or services are available for the same. Here, we pick the to…
Learn how to make your own table of contents in Microsoft Word using paragraph styles and the automatic table of contents tool. We'll be using the paragraph styles in Word’s Home toolbar to help you create a table of contents. Type out your initial …
Learn how to create and modify your own paragraph styles in Microsoft Word. This can be helpful when wanting to make consistently referenced styles throughout a document or template.

602 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question