What a “modified” timestamp actually records
When an application saves a document, the operating system usually updates a modification timestamp: a date and time associated with the file’s contents. File browsers display that value as “Date modified,” and it can help establish when a document was last saved or changed.
It is not necessarily the moment a person began editing. A word processor may save automatically, update the timestamp only when changes are written to disk, or save a temporary file and replace the original. The recorded time can therefore mark the save operation rather than the start or end of someone’s work.
Why other timestamps can tell a different story
A file may also have a creation timestamp and an access timestamp. Creation generally refers to when that file instance appeared in a particular location; copying or downloading a file can make that time differ from when the document was first written. Access time refers to a read or opening, but some systems do not update it consistently because doing so would create extra disk activity.
The displayed time also depends on the device’s clock and how the file system stores and presents time. Moving a file between devices or systems can change which timestamps are preserved, and software can sometimes alter them.
A useful clue, not a complete timeline
For everyday use, the modification time is a quick way to find the newest version or check whether a file has changed. In a dispute or investigation, it is evidence to consider alongside other records, not proof by itself of who edited a document or what they changed. A timestamp can narrow the question to “when was this file last saved?”—but answering who, how, and why usually requires more than the file’s metadata.
