distinguish change address from real origindestination
There is no way to know for sure which address is which.  This is part of the reason why some clients use a new address for change, for privacy; an observer will not be sure which coins now belong to whom.

There is no public timestamp recording when an address was created.  If one of the addresses has been used before and the other has not, this might suggest that the new one is for the change; but it could also be that both outputs are going to two different people, or that the sender is sending coins to herself and both addresses are "change".