How to Tell If a Word Document Has Been Edited (Metadata, Versions, and Hidden Revision Traces)

A .docx file records creation and modification timestamps, authors, total editing time, revision counts, tracked changes, comments, and per-session rsid values — three layers of history most senders never clean. This guide walks the layers: core properties in File → Info, hidden revision content under All Markup view, and the raw XML inside the ZIP (docProps/core.xml, impossible date orderings, ZIP entry timestamps). It also covers what metadata inconsistencies can and cannot prove.

Key Topics Covered

• Created vs modified vs last-saved-by fields
• Tracked changes and comments hidden by view settings
• Opening a .docx as a ZIP to read core.xml
• rsid revision-session IDs in document.xml
• Signs of backdating and hand-edited metadata
• Limits: metadata is suspicion, not proof