Methodology · Metadata

The EditingDuration field in DOCX — what it actually measures

Updated May 12, 2026 · 6 min read

In docProps/app.xml, there's a field called TotalTime. Word displays it as "Total Editing Time" in File → Info → Properties. It looks like a clean answer to "how long did the student spend on this?" — and that's exactly how it gets cited in academic-integrity hearings. Most of the time, it's the wrong answer.

This page walks through what the field actually measures, what it doesn't, and how to interpret the value when you see it in a forensics report.

What TotalTime measures

Microsoft Word increments TotalTime while the document is open in Word with focus, and the user has touched the document recently enough to count as active. The exact threshold is undocumented and has shifted across Word versions, but a reasonable approximation is:

  • The window is open.
  • The window has focus (not minimized to the dock, not buried behind another window).
  • Something has changed in the document within the last few minutes.
  • The autosave / save event ticks the value.

When the window loses focus, or the user steps away for too long, the counter stops. When focus returns and editing resumes, it picks up again.

The value is stored in minutes, integer-rounded.

What TotalTime does NOT measure

  • Time spent reading the document in another app. If a student wrote in Google Docs and pasted the final draft into Word at the end, TotalTime will be the few minutes they spent in Word — not the hours they spent in Docs.
  • Time spent thinking, researching, or drafting on paper. Word can't see what's outside Word.
  • Time on macOS Pages, LibreOffice Writer, Google Docs, or Word Online. Different applications maintain different counters. Pages doesn't write to app.xml the way Word does; Google Docs uses its own revision-history system and writes a minimal TotalTime only when the user exports to .docx.
  • Wall-clock time the document existed. A document created at noon and submitted at midnight does not necessarily have TotalTime: 720; it could be 4 if the student worked for four minutes and left it sitting open.

Why a low number ≠ cheating

The most common forensics misreading: "TotalTime: 1 on a 2,000-word essay — student must have copy-pasted from AI."

It's a signal worth noticing, but it has several innocent explanations:

  1. Composed elsewhere, exported once. Google Docs is the obvious one. Many students draft in Docs and "Download as Word" at submission. The .docx Word receives at that point reflects the export, not the writing.
  2. Pages → exported to Word. macOS users do this routinely. Pages' export carries minimal Word-style metadata.
  3. Word crashed. If Word crashed mid-session, the recovered document sometimes resets the timer.
  4. Family computer. If the student's account is signed in to a different Office identity than the one Word recorded the time under, the lastModifiedBy field updates but the time counter behavior can be inconsistent.
  5. Template re-use. A student starts from a class-provided template, types over it, and saves. The new content's edit time might be small.

How TotalTime is most usefully read

In combination with other signals. Specifically:

  • TotalTime: 1 AND revision: 1 AND no tracked changes is more suspicious than any of those alone. It says the document came in basically untouched after creation.
  • TotalTime: 1 AND Application: Microsoft Word AND large word count AND lastModifiedBy matches creator suggests an export from another application that wasn't Word.
  • TotalTime: 0 is its own thing. It happens on documents that were exported (e.g. Google Docs Download-as-Word) or printed-to-PDF-and-back. Treat it differently from TotalTime: 1.
  • Compare against the rest of the class. Most authentic student work clusters in the 30-minute to 4-hour range for a 2,000-word essay. Outliers in either direction (1 minute OR 200 hours) deserve a second look.

The high-end is also informative: TotalTime: 800 (13+ hours) on a one-page reflection is unusual. It usually means the student left the document open in the background for days while working on other things. Not a sign of cheating; a sign that the field measures "open with focus" not "actively typing."

What Autotend Forensics does with this

The forensics scoring engine reads TotalTime and flags two cases as low-severity signals:

  • TotalTime ≤ 2 minutes on a document ≥ 1000 words. This fires the timeline-anomaly detector.
  • TotalTime significantly out of class-distribution. This is part of the per-paper rolling baseline — comparing one submission against the rest of the same assignment's submissions.

Neither one alone produces a "high-severity" notification. Both fire as observations the instructor can investigate, not verdicts.

For the full set of metadata fields and what each one means, see the metadata signals deep-dive.

What to do when you see a suspicious TotalTime

  1. Don't act on it alone. Pull the rest of the scan signals first.
  2. Ask the student about their workflow. "Did you write this in Google Docs?" gets you most of the way without accusation.
  3. Check lastPrinted, revision, and created for consistency. A created date 5 minutes before submission with TotalTime: 1 and revision: 1 is a much stronger signal than TotalTime: 1 alone.
  4. Drop the file into forensics.autotend.io for a structured report of every related signal.

The field exists; it's worth checking; it's not by itself an answer.