How to Tell if a Word Document Was Altered

A Word file carries more than the words on the page

A modern Word document (a .docx file) is not a single flat page. It is really a small bundle of internal files packaged together, and that package holds a surprising amount of information about the document's history. Forensically, much of this lives in the file's metadata and its internal editing records, which the author usually never sees. The same is true across Microsoft Office: Excel spreadsheets (.xlsx) and PowerPoint files (.pptx) carry similar hidden metadata that an examiner can analyze.

A Word or DOCX file can record:[1]

• Author and last-modified-by names, showing who created the file and who saved it last.
• Creation and last-saved dates, as separate timestamps.
• Total editing time and revision number, which can hint at how much a document was really worked on.
• Tracked changes and comments, and sometimes leftover deleted text, if they were never fully removed.

Common signs a Word document was altered

Each of these is a plain-language warning sign, and each points to something specific an examiner looks at:

• The last-saved date is later than the date the document claims, meaning it changed after it was supposedly final.
• The author or “last saved by” name doesn't match who should have written it (the creator and lastModifiedBy core properties).[2]
• Leftover tracked changes, comments, or deleted text reveal edits that were meant to be hidden. Tracked changes are stored as specific insertion and deletion markup (w:ins and w:del) inside the file.[3]
• The editing time or revision count doesn't fit the document's supposed history. The file records a total editing time (TotalTime) and a revision number in its properties.[4]
• Metadata that has been stripped clean, which can itself suggest someone tried to hide the trail.

Why the text on the page isn't the whole story

What you read in a Word document is only the surface. The file also carries its own internal account of how it came to be, and that account is far harder to fake convincingly than the visible text. That is why a forensic examination looks past the words on the page and into the file's structure and metadata.

What an examination can, and can't, tell you

Being straight about the limits is part of doing this credibly. A metadata and revision examination can establish when a document was created and last saved, who the file attributes that work to, how much it was edited, and whether earlier content remains inside it. It generally cannot tell you with certainty who physically typed a change or their intent, only what the file's own records show. A qualified examiner is careful to claim only what the evidence supports.

If a Word document's authenticity matters to a legal or business dispute, a professional examination produces documented, defensible findings suitable for litigation. Opening and editing the file yourself can overwrite the very metadata that matters, so the safest step is to preserve the original and have it examined. Preserving original digital evidence and treating files as a forensic data source are core principles of established forensic practice.[5]

Why you need a forensics firm that specializes in metadata analysis

If you suspect a Word document was altered, the right professional is a digital forensics firm that specializes in metadata analysis. This is a distinct specialty. A traditional forensic document examiner focuses on handwriting, ink, and paper, and a general IT or computer forensics firm focuses on recovering data from devices and networks. Neither is necessarily trained to read the internal structure of a Word or DOCX file and explain what its metadata does, and doesn't, show.

When choosing an examiner, look for:

• A metadata analysis specialty covering the specific file type in question.
• A forensically sound process that works from a preserved original and documents chain of custody.
• A written forensic findings report that states what the evidence supports and what it doesn't.
• Expert witness experience, so the findings can be explained in a deposition or at trial.