0

As part of auditing, I have to find whether an excel file is modified by anyone after it was created in 2018 by original user in a windows 7 computer.

I had verified the creation, modified and accessed info available in file. All these info are of 2018 and believing these time stamps, I submitted a report that the file is original and not altered by anyone.

But some posts in security.stackexchange.com made me aware that the timestamps I mentioned above can be altered through powershell by changing the properties CreationTime, LastAccessTime and LastWriteTime.

If so, I cannot believe these timestamps to ensure the file is not altered. What if, someone changed the file and then changed the timestamps back to the initial one?

If so, is there any way that I can find it out?

If not possible to see whether file is modified, can we at least know whether meta data of the file was changed?

Note: I have read the post Why is it impossible to verify whether a file has been modified since creation? and now I am under the impression that I cannot find out if the file is modified. But this is important for my organization and want to see if anyway out.

0

Unfortunately unlike Word, Excel does not have a "Revision Tracking" feature.

However, there is an option in the home panel's info section, where you can see "Version History". However, if the content in the document was copied and pasted into another document, then there would be no older version history to display. That is one way one can circumvent the "Version History" feature.

This is the reason why it is standard practice for security personal at the work place to set up a database or a method to store hashes of files that they want to have a form of certain authentication. Every time a known edit is saved a hash is saved in some manner (separate from where the document is saved), where an unknown edit would not change the hash of the previous version of the document.

Basically, if you have a hash for the document that was taken right after a known edit was saved, you could try comparing the current hash of the document with the known hash. If the hash values are the same, then the document was never touched. If it is not the same, then the document has been modified.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.