- Nationwide Digital Forensic & Cyber Investigation Services
Read core.xml, app.xml, and custom.xml to distinguish stored document properties from independently recorded events. Author names, creation dates, application versions, and editing minutes answer different questions.
Home › Digital Evidence Authentication › Word Document Authentication › DOCX Metadata and Document Properties
Quick Answer. DOCX metadata is stored principally in docProps/core.xml, docProps/app.xml, and optional docProps/custom.xml. It records declared authors, creation and modification dates, software information, and document statistics. These properties can survive Save As or template reuse. Examiners compare the exact XML values with independently collected attachments and version records before assigning a date or author to disputed content.
This property guide is part of Word Document Authentication. Start with DOCX file structure to locate the property parts, then compare their counters with RSID editing evidence. The central question is whether the stored properties describe this document's current contents or an earlier source from which it developed.
| Question | Short answer |
|---|---|
| Where are DOCX author names stored? | dc:creator and cp:lastModifiedBy normally appear in docProps/core.xml. They are stored identity labels, not authenticated signatures or a complete list of contributors. |
| What does cp:revision count in DOCX metadata? | It is an application maintained revision value, commonly associated with saves. It does not count individual keystrokes, identify every editing session, or establish how many people worked on the document. |
| Are dcterms:created and dcterms:modified UTC dates? | Word commonly writes these properties in W3CDTF notation with a trailing Z for UTC. Read the literal suffix or offset before converting the value for a local timeline. |
| Does DOCX TotalTime measure active writing? | No. TotalTime reports editing duration in minutes according to the saving application's behavior. It is not a stopwatch of keyboard activity and cannot date a particular sentence. |
| What does AppVersion 16.0000 identify? | It is an application version string found in extended properties. The Office 16 family covers multiple releases, so this value alone cannot identify an exact product build or saving date. |
| Can Save As retain the DOCX creation date? | Yes. Saving an existing document under another name can preserve its internal creation property while producing new file system dates. That combination is not, by itself, evidence of backdating. |
The core property that stores the declared document creator, often inherited from a user profile or source document.
The label recorded for the last modifying identity by the saving application.
The declared internal creation date, distinct from a storage volume's file creation timestamp.
An optional stored date associated with printing, not a record of printer output or delivery.
An extended property expressing reported editing time in minutes.
An extended application version string whose precision depends on the writer.
A typed Unicode string value used in custom properties, distinct from numeric and date types.
The core property part stores assertions about the document. It is not an audit ledger. An examiner extracts docProps/core.xml directly from the preserved package rather than relying only on the properties panel, which may format dates locally or omit fields. XML namespace bindings determine what an element means; a prefix such as dc is a convenient label, not the namespace itself.
| Core element | Example or unit | Question it addresses |
|---|---|---|
| dc:creator | Alice Morgan | Which creator label was stored? |
| cp:lastModifiedBy | Legal Department | Which modifying label did the writer retain? |
| cp:revision | 12 | What revision value did this writer report? |
| dcterms:created | W3CDTF date with Z | What creation instant is asserted internally? |
| dcterms:modified | W3CDTF date with Z | What modification instant is asserted internally? |
| cp:lastPrinted | Optional date value | What printing related date survives? |
A creator name may come from a template, a shared workstation, a configured Office profile, or a document reused from another matter. A last modifying label may identify an organization rather than a person. Report spelling, whitespace, and empty values exactly. Matching a name to an employee directory adds context but does not establish that employee typed or approved the disputed wording.
For an illustrative time of 14:30:00Z, the Z means UTC. Keep the complete original date string in the examination record and place any local conversion in a separate column with its time zone. An explicit offset requires its own conversion. A value without a clear zone must not silently acquire the examiner's local zone. The date can reflect a system clock or later property editing; a consistent UTC suffix does not validate the clock.
cp:lastPrinted deserves separate treatment. A populated value does not establish that a named printer produced a physical copy, that all pages printed, or that anyone received them. Compare it with available print service records if printing is material. Descriptive fields such as dc:title, dc:subject, and cp:keywords may reveal template reuse, but they are ordinary editable labels.
Provide the native attachment and the event being tested. We compare literal property values, inherited template information, and independently recorded versions to explain what the date does and does not establish.
Request Confidential Consultation Call (833) 292 3733docProps/app.xml contains extended properties maintained by the document writer. Application and AppVersion describe software labels; TotalTime, Pages, and Words are reported statistics. These values do not form a single chronological record, and different applications update them differently.
| Extended field | Illustrative value | Interpretation |
|---|---|---|
| Application | Microsoft Office Word | Reported producer label, not executable verification |
| AppVersion | 16.0000 | Broad version family rather than precise build identification |
| TotalTime | 37 | Reported editing minutes, not 37 minutes of active typing |
| Pages and Words | 8 and 2410 | Stored statistics that can differ from a fresh rendering |
| Template | Normal.dotm | A template label compatible with ordinary Word defaults |
| Company | Example Services | An organizational label that may outlive its source |
A document with TotalTime of 37 may have existed for months, contained imported text, or remained open without continuous user activity. A zero value can result from a writer that does not maintain the statistic. Dividing Words by TotalTime does not yield a defensible typing speed. Likewise, cp:revision of 12 and 20 retained RSIDs are not automatically contradictory: they describe different mechanisms.
Pages depends on pagination, fonts, layout, and application behavior. Words can differ according to counting rules and whether fields, notes, or other stories are included. Preserve the stored statistics before opening the document, then label any recomputed totals as a separate experiment. A mismatch is a question about update behavior, not immediate proof of inserted pages.
AppVersion 16.0000 spans multiple Office products and years. Another writer can preserve or imitate that value. Template Normal.dotm does not establish which computer supplied the template or whether its macros ran. Company and Manager may be blank, inherited, or manually edited. DocSecurity is a limited property indicator; it is not a substitute for examining actual encryption and document protection structures. For the surrounding parts, see DOCX XML parts.
docProps/custom.xml holds optional named properties with typed values. A contract management system might store MatterNumber, ApprovalState, or RecordId. Each property can carry a name, a property identifier, a format identifier, and a value element from the variant type namespace. Extract both the name and the type; a string containing digits is not necessarily an integer.
A custom RecordId is useful when an independently collected repository record contains the same identifier and a matching attachment. Without that comparison, it remains an editable assertion inside the disputed file. Record duplicate names, unexpected types, empty values, and unresolved references rather than flattening everything into a simple spreadsheet column that loses distinctions.
Custom properties may also feed visible fields in the document. Compare the stored property with any displayed field result and the field instruction that references it. A cached result can remain stale until fields are updated. Do not update the original to make the display agree: preserve the disagreement and test update behavior on a separate copy.
The absence of custom.xml is ordinary when no custom properties were created. Its presence does not establish enterprise origin, and its removal does not automatically establish concealment. A repository export, privacy cleanup, or another editor may alter the property set. The relevant comparison is the actual workflow and its expected outputs.
Save As commonly continues an existing document's internal history instead of declaring that all content was newly composed. A renamed agreement can therefore retain dcterms:created from its source while dcterms:modified advances and the destination volume records a new file creation event. These observations concern different objects: document properties, the latest save, and a file system entry.
Suppose a submitted file claims an internal creation date in January but was attached to an email in March. That does not show the March wording existed in January. Obtain the January source, if available, and compare the disputed passage. The March attachment can establish that those exact bytes were transmitted by the independently recorded event; it cannot alone reconstruct the earlier text.
Build a property comparison across the source template, the disputed file, and known versions. An identical creator, title, company, and creation date can support reuse of an earlier source. Distinct later modification dates may then fit a normal revision sequence. If the claimed history requires a file to predate software features found inside it, examine the package and comparison samples rather than relying on one broad version string.
Properties can be edited through Word interfaces, automation, privacy controls, or direct XML replacement without visibly changing the pages. Conversely, a routine save can change properties while leaving the disputed clause untouched. A defensible conclusion identifies the specific inconsistency, corroborating records, and tested alternative explanations. See DOCX forgery detection for combining property findings with structural evidence.
Extract properties before any application save, then compare each value with the event it is claimed to describe.
We extract Word property sets, compare source templates and attachments, and explain whether author labels and dates fit the asserted document history. The report distinguishes stored assertions from events established outside the file. Our examiners are subject matter experts in DOCX metadata analysis and compare core, app, and custom properties against file system and email records.
Elite Digital Forensics is an independent digital forensics practice serving attorneys, paralegals, in house counsel, insurers, lenders, businesses, and individuals nationwide. Our team includes former law enforcement forensic examiners and court qualified expert witnesses in computer, cell phone, cloud, document, and multimedia forensics. Every engagement begins with a scoped plan, hash verified evidence handling, and a clear explanation of what the examination can answer.
Yes. A second user, a shared profile, or a reused source can produce different labels. Compare the identities with the collection context and actual versions before attributing a change.
No. It is a stored property rather than a printer audit event. Physical output, destination, page count, and receipt require other evidence.
Stored statistics can be stale, and layout or counting rules can differ. Preserve the original values and document the application, fonts, and settings used for any fresh calculation.
An approval property records a value, not an authenticated managerial act. Compare it with repository activity, approval records, and the version actually approved.
Not necessarily. Internal properties describe the document as reported by its writer; storage timestamps concern a particular file entry. Copying, extraction, synchronization, and Save As can separate them.
Yes. Property XML can change without altering document text or layout. Authentication therefore examines the native package and independent records, not only the rendered pages.
Preserve the file and its delivery records before correcting author names or updating fields. A property comparison can identify inherited values and focus the request for earlier versions. As court qualified experts in document metadata, we can explain author and date conflicts in plain language.
Request Confidential Consultation Call (833) 292 3733This content is for educational and informational purposes only and does not constitute legal advice. Elite Digital Forensics provides independent digital forensic services and expert witness testimony; we do not provide legal representation. Every case is fact specific; outcomes depend on the evidence, jurisdiction, and counsel. Retain qualified legal counsel for advice about your matter.
Elite Digital Forensics Assistant
By submitting this form, you consent to be contacted by email, text, or phone. Your information is kept secure and confidential. Reply Stop to opt out at anytime.
IMPORTANT: Please remember to check your spam or junk folder