Yes. The “Date created” and “Date modified” you see on a file can be changed in seconds with tools built into Windows, macOS and Linux, and they also change on their own when files are copied, synced or restored. That’s why file dates are weak evidence of when something existed. Here is what each date really means, what is harder to fake, and how to make a date anyone can check.
Disclosure: I’m Inna Hall, co-founder of TimeBinder, the file timestamping tool mentioned below. This page is general information, not legal advice.
Table of Contents
The dates your computer shows
- Created (Windows “Date created”, macOS “Created”, Linux “Birth” on most modern file systems): when this copy of the file appeared on this disk. It is not when the content was first made.
- Modified: when the file’s contents were last written.
- Accessed: when the file was last read. Many systems don’t update it reliably, so it means little.
How easily they change
By accident. Copying a file on Windows gives the copy a new created date while keeping the old modified date, so the copy can look as if it was modified before it was created. Downloading from cloud storage, extracting from a zip or restoring a backup can set new dates. Syncing between devices can change them again.
On purpose. Every major operating system lets a user set file dates directly: PowerShell on Windows can assign any created or modified time, the touch command does the same for modified dates on macOS and Linux, and free utilities exist for the rest. No special skill is needed. So a file date is, at most, a hint.
Metadata inside the file
Many formats carry their own dates: EXIF in photos, the core properties in Word and Excel files, CreationDate in PDFs, and project data in DAWs and CAD tools. These survive copying better than file-system dates, but anyone with the file can edit or remove them with widely available tools such as ExifTool or the document’s own properties panel. They are useful supporting detail, not independent evidence.
What forensic examiners look at
A forensic examiner can sometimes spot changed dates. On Windows NTFS, for example, each file has two sets of timestamps, and editing tools often change only one, leaving a mismatch. Examiners also compare system logs, backups, cloud records and emails. This is expensive, needs the original device, and doesn’t always give a clear answer. It is far better to have a record that never depended on your own computer’s clock.
A date someone else can check
The fix is to create evidence outside your device at the moment that matters:
Keep the original file untouched. Work on copies.
Send or store it somewhere independent: a sent email with the attachment, a shared drive with version history, or a public post. These help, but the records belong to someone else and can be lost.
Timestamp its fingerprint. A SHA-256 hash is a 64-character fingerprint of the exact bytes. Any change, even one pixel or comma, gives a completely different hash. Anchoring that hash in a public record gives verifiable evidence that the file existed no later than that time. You can see a file’s fingerprint with our free SHA-256 file hash checker, which runs in your browser without uploading anything.
With TimeBinder, you drag files into the app, they’re hashed locally and never uploaded, and the fingerprint is anchored to Bitcoin. You get a Proof of Time Certificate that anyone can use to check the file later. The free plan includes 1 Token a month (one Pooled TimeBind of up to 10 files); Essential is US$20 a month for 5 Tokens and Expert US$50 a month for 15 Tokens. See pricing.
A timestamp shows when a file existed and that it still matches its fingerprint. It doesn’t show who made it, and it can’t date a file earlier than the day you timestamp it, so do it when the file is created or first shared. To confirm a file later, see how to check a file still matches its fingerprint. For other methods compared side by side, see how to prove a file existed before a date.
Frequently Asked Questions
Can a file’s created date be earlier than its modified date?
Yes, and the reverse too. Copying a file on Windows often gives the copy a created date later than its modified date. That’s normal and doesn’t mean anyone tampered with it.
Are photo EXIF dates reliable?
They come from the camera’s clock, which may be set wrong, and they can be edited. They’re helpful context but not independent evidence.
Does a screenshot of file properties prove anything?
Very little. It shows what the dates said on one computer, and those dates can be changed before the screenshot is taken.
Can I timestamp a file I made years ago?
Yes, but the record will show it existed no later than the day you timestamp it. For older work, gather emails, backups and other records that show earlier dates.
Plan details were checked against timebinder.io/pricing on 29 October 2026.
