Every file on every modern operating system carries multiple timestamps. The "creation date," the "modified date," the "accessed date," and (for many file types) embedded application-level timestamps that may or may not agree with the file-system timestamps.
The most common misreads that cause attorneys problems:
1. Trusting the visible "Date" column. Different file managers, different operating systems, and different applications all surface different timestamps as "the" date. The one shown in Finder or Explorer is rarely the one that matters for evidentiary purposes.
2. Assuming "Created" means "created." On many systems, "Created" reflects when the file landed on this particular device — not when it was originally authored. Copying a file from one device to another resets the "Created" timestamp.
3. Confusing application-level timestamps with file-system timestamps. A Word document's "Last Modified" timestamp as shown by Word's properties may be hours or weeks different from the file-system "Last Modified" timestamp. Both are real; they mean different things.
4. Forgetting time zones. Timestamps stored in UTC vs. local time vs. the time zone of the system that originally created the file. A 3-hour discrepancy that looks like fabrication is often just a time zone conversion.
5. Trusting "Last Accessed" on Windows. Most modern Windows installations disable last-accessed timestamp updates for performance reasons. The displayed "Last Accessed" date is often meaningless.
The practical fix: when timestamps matter, engage a forensic professional rather than reading them out of file-manager properties.