'Last Modified By' in a docx — what it means and what it doesn't

In docProps/core.xml, every .docx file carries a field called <cp:lastModifiedBy>. Word writes the current user's display name into that field every time the document is saved. It looks like a clean record of who last touched the file. In practice, it has a few quirks that make it less of a "signature" than instructors sometimes treat it as.

Where the name comes from

The value is whatever the operating-system or Office identity is currently configured as. Specifically:

• Word for Windows / macOS writes the value from File → Options → General → User Name (Windows) or Word → Preferences → User Information (macOS).
• Word Online writes the signed-in Microsoft 365 account's display name.
• Google Docs Download-as-Word writes the Google account's display name, or "Anonymous" if downloaded while not signed in.
• LibreOffice Writer writes the value from Tools → Options → LibreOffice → User Data → First/Last name.
• macOS Pages → Export to Word writes the iCloud or local user's name.

The field gets overwritten on every save. There is no historical list of past lastModifiedBy values inside the docx — only the most recent one.

What this means for forensics

creator vs lastModifiedBy

The <dc:creator> field is set once, at document-create time. <cp:lastModifiedBy> is set on every save. The two fields can diverge for legitimate reasons:

• Student drafts a paper on their roommate's laptop (created by roommate), then saves on their own laptop (last-modified by themselves).
• Student receives a template from the instructor (created by instructor), then fills it in (last-modified by student).
• Student submits a Google Doc that was downloaded as .docx from a shared library (created by the original sharer, last-modified by the student or "Anonymous").

When creator and lastModifiedBy are identical, that's the "single author, single workstation" pattern — what most authentic student work looks like.

When they differ, it doesn't mean anything bad on its own. It means a transition happened. The interesting question is whether the transition matches the student's account of their workflow.

"Anonymous" or empty values

Several conditions produce lastModifiedBy: "" or lastModifiedBy: "Anonymous":

• The file was downloaded from a shared Google Drive while signed out.
• The file passed through an automated converter (some online "PDF to Word" tools strip identity fields).
• The user is on Word with a generic local account ("User", "DESKTOP-XYZ\Admin").

These values aren't suspicious by themselves; they're consequences of common workflows. But "Anonymous" combined with created ≈ modified ≈ submission-time, plus a TotalTime of 1 minute, is a very different pattern from a normal Google Docs export. See the EditingDuration field explained for the timeline-side interpretation.

Misspellings, generic names, and typos

lastModifiedBy: "user", lastModifiedBy: "asd", lastModifiedBy: "Yamada" (where the student's name is unrelated) are observation-worthy. Most students leave their real name in the Office identity, so a generic or unrelated value reads as either:

1. A shared workstation (lab, library, family computer).
2. The student's first time saving in Office and they hadn't configured the identity yet.
3. The file came from somewhere else — a tutor, a paper mill, a friend.

None of those is conclusive on its own.

How lastModifiedBy can be spoofed

The field is editable. Open Word's options, change the user name, save the file, and the new name overwrites the previous one. There's no audit trail of past edits.

This means a student who knows about the field can set it to whatever they like before submission. In practice, students who do this usually overcorrect and pick a value that looks too neat — exact case, no abbreviations, matching their LMS display name perfectly when their own Office identity would normally show informal variants.

The relevant forensics signal isn't "the value is wrong" — it's "the value is unexpectedly tidy compared to the file's other identity fields." A lastModifiedBy: "Sarah Johnson" paired with creator: "Sarah Johnson" paired with no other identity drift across multiple submissions is normal. The same paired with an outlier TotalTime and a missing edit history is a different shape.

What Autotend Forensics looks at

The metadata signal-set in the scoring engine reads:

• creator and lastModifiedBy for consistency with the student's roster name.
• Whether either field is empty, "Anonymous", or a generic placeholder.
• Whether the pair has drifted across submissions in a way that doesn't match the student's stated workflow.

These produce observations, not verdicts. The aggregate is one input into the per-paper rolling baseline.

Common misreadings

• "It says someone else last modified it, so it's not the student's work." Could be a shared workstation, could be a template handoff, could be a co-author the student didn't mention. Ask before assuming.
• "The name matches, so it's authentic." The field is editable. A clean match is consistent with authenticity but not proof of it.
• "The student denies modifying the field; therefore they didn't." Students often don't know the field is editable. Their denial doesn't tell you much either way.

The honest read of this field is: "evidence of who held the keyboard at last-save time, subject to whatever identity that workstation was configured for, with no history of prior values." It's useful in aggregate with other signals. It's not a signature.

For the full structural-signals methodology, see the metadata signals page.