What is the difference between created, modified, accessed and received time?¶
title: What is the difference between created, modified, accessed and received time? subtitle: These labels describe different events and may refer to the file, database record, message or local copy. slug: what-is-the-difference-between-created-modified-accessed-and-received-time series: mobile-extraction-and-reader-reports section: timestamps-and-timelines card_type: question_card content_type: foundation risk_level: normal pathway_order: 46 section_order: 6 status: draft owner: IF Digital last_updated: '2026-07-25' version: '0.1' review_gate: pending review_mode: ai-assisted review_timebox_mins: 30 qa_gate: pending qa_count: 0 pipeline_ref: PIPELINE_PRG_001 pipeline_version: '1.1' public_safe: true video_ready: true word_count: 440 estimated_read_time_seconds: 182 audiences: - investigator - supervisor - fraud and compliance practitioner tags: - mobile evidence - created time - modified time - accessed time - received time sources: - title: SWGDE Best Practices for Mobile Device Forensic Analysis url: https://www.swgde.org/documents/published-complete-listing/20-f-005-swgde-best-practices-for-mobile-device-forensic-analysis/ - title: 'NIST SP 800-101 Rev. 1: Guidelines on Mobile Device Forensics' url: https://csrc.nist.gov/pubs/sp/800/101/r1/final
What is the difference between created, modified, accessed and received time?¶
These labels describe different events and may refer to the file, database record, message or local copy.
Script¶
Created, modified, accessed and received sound like simple labels.
Their meaning depends on the system and artefact.
A file creation time may record when that file was created on the current storage location.
It may not record when the original content was first made.
A photograph captured elsewhere and downloaded to the handset may have a file creation time equal to the download date.
The image metadata may contain an earlier camera capture time.
A file copied during restore or migration may appear newly created even though the content is old.
Modified time normally records when the file content or metadata was last changed according to that file system.
Opening, editing, synchronising, converting or rewriting the file may update it.
Some applications preserve the original modification time during copying.
Others replace it.
The database file’s modification time may update whenever any record inside it changes, not specifically when the artefact you are reviewing changed.
Accessed time may record when the file was read or accessed.
Many systems reduce, delay or disable access-time updates for performance.
An application, antivirus process, indexer, backup or forensic acquisition can access a file without a user deliberately opening it.
The absence of an updated access time does not prove the file was not viewed.
Received time is normally application-specific.
For a message, it may be when the service delivered the item, when the device downloaded it, when the local database inserted it or when the application displayed it.
An email provider, messaging service and handset may each record a different receipt stage.
Other labels include sent, submitted, captured, imported, synchronised, deleted and last seen.
Don't translate them using one universal rule.
Identify which source and field the forensic tool parsed.
Look for metadata and context outside the friendly label.
A photograph may have camera metadata, file-system times, gallery database times and cloud times.
A message may have application and provider times.
A browser download may have page visit, download start, completion and file creation times.
The common mistake is:
“The file was created on 10 June, so the user created the content on 10 June.”
The file may have arrived on the handset then.
Another mistake is:
“The accessed time proves the user opened it.”
A background service may have caused the access, and the operating system may not maintain that field reliably.
A careful conclusion might say:
“The file-system creation time records when this copy appeared in the application folder. Embedded metadata records an earlier image-capture time.”
That keeps both events clear.
Created, modified, accessed and received are technical labels.
Use the source system’s definition and avoid turning them directly into human actions.
Key takeaway
Don't treat file-system labels as universal descriptions of human activity.
Related questions¶
- Why can one artefact show several different times?
- Which timestamp in a mobile report should I use?
- Why might an application timestamp differ from the phone timestamp?
Source notes¶
- SWGDE Best Practices for Mobile Device Forensic Analysis
- NIST SP 800-101 Rev. 1: Guidelines on Mobile Device Forensics