What is the difference between created, uploaded, modified and synchronised times?¶
Created, uploaded, modified and synchronised times describe different events in a file’s history.
They should not be treated as interchangeable.
What this means in practice¶
Created time may mean when the file first existed on a device or when the cloud service created its own file record.
Uploaded time usually means when the file entered the cloud service from a device, application or another system.
Modified time means the file or its metadata changed, but the change may have been made by a user, application, conversion process or synchronisation event.
Synchronised time means the cloud service and a device exchanged or reconciled changes. It may occur long after the original creation or edit.
A file created on one device on Monday may be uploaded on Tuesday, edited online on Wednesday and synchronised to another device on Thursday.
Investigators should identify the source, time zone and event definition for each field.
What this may show¶
The same file can therefore have several legitimate timestamps.
Also check whether the file was duplicated, restored or moved between accounts, because those actions may create new timestamps without creating new content.
Where the sequence matters, explain each event separately rather than choosing one timestamp as the answer.
What this does not show on its own¶
The dangerous assumption is that the earliest timestamp identifies when the user created the content.
What to do next¶
Compare version history, audit logs, device filesystem records, application logs and file-internal metadata.
Do not assume that a timestamp labelled “created” has the same meaning across providers. Some systems reset it during upload, conversion or copying.
Key takeaway
Created, uploaded, modified and synchronised times mark different stages, so define each field and reconstruct the sequence from several records.