michiel Posted July 30, 2014 Report Share Posted July 30, 2014 the documents that we are searching for have a couple of properties, one of the properties is content created, what does this exactly mean, when will this be write down to a file and what are the differents to different properties and why does some pdf files have no properties and other some properties. Link to comment Share on other sites More sharing options...
admin Posted July 30, 2014 Report Share Posted July 30, 2014 Content created Returns a Date indicating the creation time for the message. This property corresponds to the MAPI property PR_CREATION_TIME. Read-only. Other details on file times. http://en.wikipedia.org/wiki/MAC_times Info on PDF's http://www.4n6k.com/2014/02/forensics-quickie-pdf-metadata.html Link to comment Share on other sites More sharing options...
michiel Posted August 5, 2014 Author Report Share Posted August 5, 2014 Thanks Admin, this is what i need, thank you Link to comment Share on other sites More sharing options...
AdamS Posted August 6, 2014 Report Share Posted August 6, 2014 michiel just to point out, if you are talking about the parent email (or any email) then the content created is the date the email was created as stated above, however if you are looking at the attachment to an email, or a stand alone document, then the content created timestamp refers to the creation of the document itself which will not necessarily correspond to the email content created date. Documents have their own meta data which Intella indexes and can report on. Link to comment Share on other sites More sharing options...
Recommended Posts