01Location
- <file>.docx|.xlsx|.pptx → docProps/core.xml
- <file>.docx|.xlsx|.pptx → docProps/app.xml
- <file>.docx|.xlsx|.pptx → docProps/custom.xml
02Questions it answers
- Who is recorded as author and last editor of the document?
- When does the document claim to have been created, modified and last printed?
- Which application and version, template and company name are recorded?
- How many minutes of editing time and how many revisions are recorded?
03Format and versions
| Format | ZIP package (Open Packaging Conventions) with XML parts. core.xml root cp:coreProperties using Dublin Core (dc:, dcterms:) elements; app.xml root Properties in the extended-properties namespace (ap: prefix in the Open XML SDK). |
|---|---|
| Applies to | Office 2007 and later; elements defined in ECMA-376 / ISO/IEC 29500 (extended properties in Part 1 §22.2). |
04Key fields
| Field | What it tells you |
|---|---|
| dc:creator | Creator of the package (maps to Author in Office). |
| cp:lastModifiedBy | User who last modified the content. |
| cp:revision | Revision number of the package. |
| dc:title, dc:subject, dc:description, cp:keywords, cp:category, cp:contentStatus | Descriptive properties entered by users or applications. |
| ap:Application, ap:AppVersion | Name and version of the producing application. |
| ap:Template, ap:Company, ap:Manager | Template name, company and manager names. |
| ap:TotalTime | Total time the document has been edited; default unit minutes. |
| ap:Pages, ap:Words, ap:Characters, ap:Lines, ap:Paragraphs | Statistics computed by the application. |
05Timestamps
| Field | Encoding | Note |
|---|---|---|
| dcterms:created, dcterms:modified | W3CDTF (xsi:type="dcterms:W3CDTF"), e.g. 2006-12-08T23:35:00Z | Written by the application from the local clock; the value can be edited. |
| Last printed (core property) | Date and time value in core properties | Present only if the producing application recorded printing. |
Decode raw values with the Timestamp decoder and convert local wall-clock times with the Local time to UTC.
06Examination workflow
- Hash the original file, then extract the package contents from a copy.
- Read docProps/core.xml, app.xml and custom.xml and record every element verbatim.
- Compare created/modified with file system times and with dates of embedded media or revisions in the document body.
- Assess TotalTime and revision against the claimed creation history.
07Interpretation pitfalls
- Property values come from the producing application and user settings and can be edited without special tools.
- Copying or saving from a template can carry over creator and created values from an earlier document.
- Applications other than Microsoft Office may omit or populate these parts differently.
09Sources
- How to: Manipulate Office Open XML Formats Documents Microsoft Learn (previous versions, Office 2007) · checked 2026-10-14
- Document Information Panel and Document Properties Microsoft Learn (previous versions, SharePoint 2007) · checked 2026-10-14
- PackageProperties class Microsoft Learn (.NET API) · checked 2026-10-14
- DocumentFormat.OpenXml.ExtendedProperties.Properties class Microsoft Learn (Open XML SDK) · checked 2026-10-14
- DocumentFormat.OpenXml.ExtendedProperties.TotalTime class Microsoft Learn (Open XML SDK) · checked 2026-10-14