Open a file’s properties and you may see three or four different dates that don’t agree: a created date after the modified date, a photo “taken” on one day but “created” on another, a brand-new document that claims to be years old. People sometimes read these mismatches as signs that someone altered the file. Usually they are just the result of different clocks recording different things. Here is where each date comes from and why they drift apart.
Short answer: Date created, date modified and date taken are recorded by different things (the file system, the app, the camera), so they often disagree and can all be changed. If you need a date someone else can check, timestamp the exact file with TimeBinder. A TimeBind shows that the exact file existed no later than the recorded time and still matches its fingerprint. It doesn’t show who made it or what a court will make of it.
Disclosure: I’m Inna Hall, co-founder of TimeBinder, the file timestamping tool this guide uses. This page is general information, not legal advice.
Table of Contents
Two kinds of dates
- File system dates (created, modified, accessed) are kept by the operating system about a particular copy of a file. They are not part of the file’s contents.
- Embedded dates are written inside the file by the app or device that made it: EXIF in photos, document properties in Office files, CreationDate in PDFs, origination dates in broadcast audio.
Because they are recorded by different software at different moments, it would be surprising if they always matched.
Where each date comes from
| Date | Who writes it | What commonly changes it |
|---|---|---|
| File system: created / birth | The operating system, when this copy was written to this disk | Copying, downloading, extracting from an archive, restoring from backup |
| File system: modified | The operating system, when the contents were last written | Saving, re-exporting, some sync tools; some copy methods keep it, others reset it |
| EXIF: date taken (DateTimeOriginal) | The camera or phone clock at capture | Editing tools and wrong camera clocks; usually kept when copying |
| Office: created / last saved (docProps) | Word, Excel or PowerPoint, using the computer clock | Inherited from templates and Save As; updated on each save |
| PDF: CreationDate / ModDate | The app that produced or saved the PDF | Re-exporting, printing to PDF, saving after any edit |
| Audio: BWF origination date | The recorder or DAW at recording or bounce time | Re-bouncing, tag editors |
Common reasons the dates disagree
- Copies get new created dates. Copying, downloading or unzipping usually gives the new copy a fresh created date, while the modified date is often kept. Our Linux tests show this step by step.
- Embedded dates survive copying. A photo’s date taken or a document’s internal created date travels with the file, so it can be older than the file system dates of the copy you are looking at.
- Templates and Save As. Office documents can inherit the created date of the file they were based on.
- Time zones. EXIF dates traditionally store no time zone. Fields for the offset (OffsetTimeOriginal and related tags) were only added in Exif 2.31 in 2016, and many files still lack them. Zip archives and the FAT file systems used on many memory cards also store local time, while NTFS and APFS store times in UTC and convert them for display.
- Wrong device clocks. Cameras and recorders that lost power, were never set, or weren’t changed for daylight saving time write dates that are hours or years off.
- Precision. FAT and zip store modified times to the nearest 2 seconds, while NTFS, APFS and ext4 store far finer times, so the same moment can appear slightly different after a round trip.
- Re-exports. Exporting a JPG from a RAW, or a PDF from a document, produces a new file with new dates even if nothing visible changed.
How to read a disagreement
A mismatch is not proof that anyone altered anything, and a perfect match is not proof that nobody did. All of these dates can be changed with ordinary tools, as explained in can a file’s date created be changed?. Forensic examiners treat them as one source among many and look for consistency with records held by others: emails, server logs, cloud histories and backups.
If you are relying on a file’s date in a dispute, write down where the file has been (which devices, which cloud services, whether it was zipped or emailed). That history explains most mismatches better than any single date.
A date others can check
The one thing that doesn’t change when a file is copied, renamed, zipped or emailed is its content, and so its SHA-256 fingerprint. A timestamp records that fingerprint outside the file and outside your control. With TimeBinder, the fingerprint is anchored to the Bitcoin blockchain and anyone can later check that the exact file existed no later than that moment, whatever its file system dates say.
Related: proving a RAW photo existed before a date, Word and Scrivener files, PDFs and the glossary of timestamping terms.
Which plan fits
The free plan gives you 1 Token a month, which is one Pooled TimeBind of up to 10 files. No credit card is required for the free plan. A Pooled TimeBind is usually recorded within 24 to 48 hours, and often sooner, depending on Bitcoin network activity; an ASAP TimeBind costs 3 Tokens and gets its own Bitcoin transaction straight away.
For more milestones, Essential is US$20 a month for 5 Tokens (5 Pooled, or 1 ASAP plus 2 Pooled). Expert is US$50 a month for 15 Tokens (15 Pooled or 5 ASAP), and unused Tokens roll over. Verification is free. See pricing.
What a timestamp does and doesn’t do
TimeBinder anchors each file’s SHA-256 fingerprint to Bitcoin and gives you a Proof of Time Certificate. That is verifiable evidence of when a file existed: it shows the file existed no later than the anchor date, and any later change to the file is detectable. An ASAP TimeBind can be checked directly on the Bitcoin blockchain without relying on TimeBinder; a Pooled TimeBind is verified through TimeBinder. Your file is hashed in your browser and never uploaded.
It doesn’t show who made the work or who owns it, it doesn’t stop copying, and it doesn’t cover a version you didn’t timestamp. It also can’t tell you which of a file’s existing dates is right; it gives you a new, independent one.
Frequently Asked Questions
Why is my file’s date created later than its date modified?
Usually because the file is a copy. Copying or downloading gives the new copy a new created date while often keeping the original modified date. It is normal and not, by itself, a sign that anything was altered.
Which date is the real one?
None of them is independent. Each is recorded by a device or app you control, for a different purpose. They are useful together as clues, but a date that someone else can verify has to come from outside the file, such as a timestamp of its fingerprint or a record held by a third party.
Why are my photo’s date taken and file date different by hours?
Common causes are a camera clock that was never set to the right time zone or daylight saving time, older EXIF dates that store no time zone, and copying or exporting the photo, which gives the file new dates while the date taken stays the same.
Why does a new Word document show an old created date?
Office documents store their own created date inside the file. If you start from a template or use Save As on an older document, that internal date can carry over, even though the file system says the file is new.
Plan details were checked against timebinder.io/pricing on 29 October 2026.
