How to Prove When a File Was Created

The date your computer shows for a file proves very little, because anyone can change it in seconds. What proves when a file existed is a record kept outside the file, by someone other than you, and tied to the file's exact contents. In the EU, the strongest such record is a qualified electronic timestamp. For files you made in the past you cannot create that record after the fact, but you probably already have outside traces worth collecting. This guide covers both, for every kind of file: photos, music, writing, designs, video and code.

This is general information, not legal advice for a specific dispute.

Why the date on your file is weak evidence

Every operating system stores dates with a file: created, modified, last opened. Photos also carry EXIF data from the camera, and Word or PDF files carry their own "created" field. All of these are written by your own device, and all of them can be edited:

• Copying resets dates. On Windows, copying a file to another folder or drive usually gives the copy a new "Created" date, so your oldest files may already show recent ones.
• Photo dates can be rewritten. Free tools such as ExifTool change a photo's capture date with one command.
• Git dates are self-reported. The commit date is set by the computer that makes the commit, and it can be set to any value.

That does not make metadata useless. It is a consistent part of a story. On its own, though, the other side can dismiss it with one sentence: "you could have changed that." What you need is a record you could not have changed.

Check what your file says today

Write down what the file shows now, so you know your starting point:

• Windows: right-click the file, choose Properties, then the General tab (Created, Modified). For photos, the Details tab shows "Date taken".
• macOS: select the file and press Cmd+I. For more fields, run mdls yourfile.jpg in Terminal.
• Linux: stat yourfile shows Birth (creation, on most modern filesystems) and Modify.
• Photos: exiftool -time:all yourfile.jpg lists every date the camera and editing software wrote.
• Code: git log --format='%h %ad %cd %s' --date=iso shows the author and commit dates of each commit.

Record these values, and treat them as notes rather than proof.

Files you already made: collect the outside traces

You cannot go back in time and timestamp a file. You can gather records that other systems made about it when it happened. Rank them by one question: who wrote this date, and could you have changed it?

Two warnings. First, a trace only helps if it points to this exact file: an email saying "here is the new track" with no attachment shows less than one with the file attached. Second, each trace dates that copy at that moment. If you have edited the file since, the edited version is a different file.

What to do now: put the strongest traces in one folder together with the version of the file they refer to, and write a short note listing what each one shows and where it came from. Then protect the file from here on, as described next.

Files from now on: timestamp before you share

The reliable method is to fix a record of the file before anyone else sees it: before you send the demo, post the photo, pitch the script or deliver the code to a client.

A qualified electronic timestamp works in two steps:

1. A SHA-256 fingerprint is calculated from the file's exact contents. It is a 64-character value; change a single byte and it changes completely.
2. A qualified trust service provider, a company supervised by a national authority under EU law, signs that fingerprint together with the current date and time.

Under Article 41(2) of the EU eIDAS Regulation, a qualified electronic timestamp enjoys a legal presumption that its date and time are accurate and that the data it is bound to has not changed since. Article 41(3) makes it recognised as qualified in every EU member state. In practice the burden moves: whoever disputes the date has to show it is wrong.

On StampR this takes a few minutes. You select the file, the SHA-256 fingerprint is calculated in your browser, and a qualified timestamp from BORICA B-Trust is bound to it together with your declaration that you are the author. Only the fingerprint is sent, unless you choose to store a copy. You receive a PDF certificate with the trusted time, the fingerprint and a QR code, and anyone can check the fingerprint on the verification page without having to trust you or StampR.

What a timestamp shows, and what it does not

Be precise about this, because the other side will be:

• It shows that this exact file existed no later than the date on the certificate and has not changed since.
• It does not show that you created the file, that nobody made something similar earlier, or how long the file existed before the timestamp.
• It does not create or record any rights. Copyright arises when you create the work.
• It cannot backdate. The certificate carries the date it was issued.

That is why timing matters. A timestamp made on the day you finish a work, before anyone else has it, leaves very little room for an earlier copy elsewhere. A timestamp made after a dispute starts only dates the dispute.

A checklist by file type

The method is the same for every file. Only what you keep differs.

Two rules apply to every row. Keep the exact file you timestamped, unchanged: opening and re-saving a photo or document can change its fingerprint, so work on copies. And timestamp each version that matters: a certificate covers one version, so if the final cut differs from the demo, the final cut needs its own. For a whole shoot or an entire codebase you do not need one certificate per file: one certificate on a manifest of fingerprints covers all of them.

Timestamp the file you would least like to lose a dispute over. The first certificate on an account is €4.90.

If the date is ever challenged

What you hand over, to the other side, a platform or a lawyer, should answer "when" without asking anyone to trust you:

1. the certificate PDF;
2. the exact file it covers, so anyone can recalculate the fingerprint and compare;
3. the outside traces from before and after: emails, posts, version history;
4. your drafts and working files, which show the work being made.

The timestamp anchors the date; the traces and drafts tell the story around it. How much weight a court gives each piece depends on the country and the case. For a real dispute, talk to a lawyer where you live.

The wider context: copyright protection: how the right arises, and where it is weak in practice.

Related reading

• Authorship evidence: every option and what it costs
• One certificate for hundreds of files
• Do timestamp certificates hold up in court?

Frequently asked questions

Can someone change the creation date of a file?

Yes. On every major operating system the created and modified dates can be changed with built-in commands or free tools, and photo dates can be rewritten with EXIF editors. That is why these dates count as weak evidence on their own.

Does emailing a file to myself show when it was created?

It shows that the email, with that attachment, passed through a mail server at a certain time, which is better than nothing. Mail providers are not regulated timestamp services, the full message with headers must be kept, and it dates the sending, not the creation.

Can I timestamp a file I made years ago?

Yes, but the certificate shows today's date. It covers the file from now on; for the earlier period, rely on the outside traces described above.

Does a timestamp show that I am the author?

Not on its own. It shows that the file existed at a certain time. Authorship is shown by the timestamp together with your drafts, working files and other evidence. A certificate issued before anyone else had the file is a strong part of that picture.

Is a qualified timestamp valid outside Bulgaria?

Within the EU, yes: Article 41(3) of the eIDAS Regulation says a qualified timestamp issued in one member state is recognised as qualified in all of them. Outside the EU it is ordinary evidence whose weight depends on local rules.

Sources

• Regulation (EU) No 910/2014 (eIDAS), Article 41: legal effect of qualified electronic timestamps.
• ExifTool documentation: reading and writing photo date tags.
• git-commit documentation, date formats: author and committer dates can be set by the committer.
• Internet Archive, Save Page Now: a third-party dated copy of a public page.

Sources checked 2026-11-05.