drop document files or metadata csv · extract internal document timestamps · compare against filesystem creation and modification times · detect document timestamps inconsistent with filesystem evidence · runs locally
internal vs SI timestamps · doc created >1h before fs · mod >60s after fs mtime · created >30d after fs · revision on new file · app version vs create year
drop docx xlsx pptx pdf (and optional mft/metadata csv) — browser exposes file mtime; pair with SI_Created/SI_Modified csv for full NTFS comparison