As part of auditing, I have to find whether an excel file is modified by anyone after it was created in 2018 by original user in a windows 7 computer.
I had verified the creation, modified and accessed info available in file. All these info are of 2018 and believing these time stamps, I submitted a report that the file is original and not altered by anyone.
But some posts in security.stackexchange.com made me aware that the timestamps I mentioned above can be altered through powershell by changing the properties CreationTime, LastAccessTime and LastWriteTime.
If so, I cannot believe these timestamps to ensure the file is not altered. What if, someone changed the file and then changed the timestamps back to the initial one?
If so, is there any way that I can find it out?
If not possible to see whether file is modified, can we at least know whether meta data of the file was changed?
Note: I have read the post Why is it impossible to verify whether a file has been modified since creation? and now I am under the impression that I cannot find out if the file is modified. But this is important for my organization and want to see if anyway out.