How do you prove a document was backdated?

The document testifies against itself#

A backdated document has to lie consistently across every layer of its own construction, and almost none do.

• Application metadata. Office documents and PDFs embed creation and modification timestamps, author fields, editing time, and revision counts — separate from the file system's dates and frequently forgotten by whoever adjusted the visible date.
• Software fingerprints. Files record the application and version that produced them. A contract dated 2019 saved by a word-processor build released in 2023 is not a 2019 document, and the same logic applies to embedded fonts, which ship on identifiable dates.
• Internal structure. Modern Office files are containers of XML parts, each with its own timestamps; PDFs accumulate incremental updates that preserve earlier versions inside the file. An examiner can often see the document's editing history layered within the single file being proffered.

The systems around it testify too#

Even a carefully manufactured file exists inside an environment that was not manufactured:

• File-system records show when the file appeared on the computer — a creation date after the document's face date needs explaining.
• Email and messaging show when the document first moved between people. A "2019 agreement" that no mailbox, chat log, or attachment record contains before 2024 has a provenance problem.
• Backups and shadow copies are point-in-time snapshots: if the document genuinely existed in 2019, the 2019 backup should contain it. Its absence there is affirmative evidence.
• Cloud version history in Google Workspace, SharePoint, and similar platforms records every revision with server-side timestamps the user cannot edit.

The convergence is the proof. Any single artifact might have an innocent explanation — clocks drift, files get migrated — so a defensible opinion tests the innocent explanations against the full pattern rather than resting on one timestamp, the same closing-off-alternatives discipline that carries a data-theft timeline.

Manipulation leaves its own marks#

Tools that alter file timestamps exist, and using one is itself detectable more often than users expect — mismatches between the layers above, timestamp precision anomalies, and records of the tool's own presence on the system. In Calsep v. Dabral, manipulation and deletion of electronic evidence did not rescue the case; it ended it, by default judgment.

What to do now#

Get the original electronic file, not a printout or a PDF-of-a-scan — paper strips out every layer discussed above. Preserve the computer or account it came from, and pull the surrounding records (email, backups, version history) before retention policies age them out.