File creation dates don't necessarily tell you when a file was originally created

A file created today could actually be 10 years old.

Imagine a document originally created in 2016.

You copy it to another computer in 2026.

Depending on the operating system and method used, the file's creation timestamp may now show 2026.

Does that mean the document was created in 2026? No.

3 practical checks in digital forensics

1. Compare timestamps: Examine Created, Modified and Accessed dates.
2. Inspect embedded metadata: Office documents, PDFs and photographs may contain additional dates.
3. Check the file's history: Look for older copies, emails, cloud versions and backups.

Remember that timestamps and metadata can also be manipulated.

The takeaway: A file's creation timestamp may describe that particular copy, rather than the original document.