Metadata Holds Significant Value for Legal Proceedings

Metadata, the often overlooked treasure trove of information in litigation, holds significant value for legal proceedings. Beyond its role as data about data, metadata serves as a powerful tool to establish the chronology of events, authenticate digital evidence, and identify the parties involved. In civil litigation, it can prove vital in establishing when a document was created or modified, the authorship of files, and the location where they originated or were altered. This paper delves into the paramount importance of metadata in civil litigation, shedding light on how it bolsters cases by providing indispensable information to substantiate facts and evidence in court. Here, we explore the top reasons why file metadata assumes a crucial role in digital forensics investigations within civil litigations.

Time and Date Information: File metadata can provide important information about the time and date that a file was created, modified, or accessed. This can help to establish the chronology of events and can be used to prove that a file was created or modified at a specific time.

Identification of the Author: File metadata can also provide information about the author or creator of a file. This can be useful in identifying who created a document or who made changes to a file.

Location Information: File metadata can contain information about the location where a file was created or last modified. This can help to establish the location of the parties involved and can be used to prove that a file was created or modified in a specific location.

File History: File metadata can provide a history of the changes made to a file, such as when it was created, modified, and accessed. This can help to establish the chronology of events and can be used to prove that a file was created or modified at a specific time.

File Type and Format: File metadata can provide information about the type and format of a file. This can be useful in determining the original file format and can be used to prove that a file has been altered or tampered with.

Device information: File metadata can contain information about the device used to create or modify a file, such as the device’s make and model. This can be used to identify the device that was used to create or modify a file and can be used to link a device to a specific user.

Authentication: File metadata can be used to authenticate a file by verifying its integrity and originality. This can be useful in proving that a file has not been tampered with or altered.

Evidence Corroboration: File metadata can be used to corroborate other forms of digital evidence, such as email or social media communications. For example, metadata from a file can be used to confirm the date and time a file was created, which can be used to confirm the date and time a related email was sent.

Evidence Preservation: File metadata can be used to preserve the originality of a file and to prove that the file has not been tampered with. This can be important in preserving the integrity of the evidence and can be used to prove that a file is authentic.

Conclusion

In conclusion, file metadata is important in digital forensic investigations for civil litigations because it can provide important information about the time, date, location, author, file history, and device information of the file. It can also be used to authenticate, link and preserve the integrity of the evidence. The ability to extract, analyze and interpret the metadata, by a digital forensics expert can help to establish the chronology of events, identify the parties involved and support the evidence being presented in court.

At Forensic Discovery, we’re with you every step of the way. Past just finding information such as metadata, one of the most important parts of a digital forensics analysis is placing the data into a searchable and sortable database. We provide this service, along with training, for our hosted ediscovery review – a powerful feature for searching and sorting data.

Files Types Containing Metadata Examples:

AFCP, AIFF, APE, APP12, Apple, ASF, BMP, BPG, Canon, CanonCustom, CanonRaw, CanonVRD, Casio, Composite, DarwinCore, DICOM, DJI, DjVu, DNG, DPX, DV, EXE, EXIF, Extra, FITS, FLAC, Flash, FlashPix, FLIF, FLIR, Font, FotoStation, FujiFilm, GE, GeoTiff, GIF, GIMP, GoPro, GPS, H264, HP, HTML, ICC_Profile, ID3, IPTC, ISO, ITC, iWork, JFIF, JPEG, Jpeg2000, JSON, JVC, Kodak, KyoceraRaw, LNK, Lytro, M2TS, MacOS, Matroska, Microsoft, MIE, MIFF, Minolta, MinoltaRaw, MNG, MOI, Motorola, MPC, MPEG, MPF, MWG, MXF, Nikon, NikonCapture, NikonCustom, NikonSettings, Ogg, Olympus, OOXML, OpenEXR, Opus, Panasonic, Parrot, PCX, PDF, Pentax, PGF, PhaseOne, PhotoCD, PhotoMechanic, Photoshop, PICT, PLIST, PLUS, PostScript, PrintIM, PSP, Qualcomm, QuickTime, Radiance, Rawzor, Real, Reconyx, Red, Ricoh, RIFF, RSRC, RTF, Samsung, Sanyo, Scalado, Shortcuts, Sigma, SigmaRaw, Sony, SonyIDC, Stim, Text, Theora, Torrent, Unknown, VCard, Vorbis, WTV, XMP, ZIP, ZISRAW

Microsoft Office Metadata Examples:

Abstract, AccountName, AcquisitionDateTime, AlbumArtist, AlbumArtistSortOrder, AlbumCoverURL, AlbumID, AlbumIDAlbumArtist, AlbumTitle, AlbumTitleSortOrder, AlternateSourceURL, Anniversary, Artist, AssistantsName, AssistantsPhone, Attachments, Attributes, AudioBitrate, AudioFormat, AudioSampleRate, AudioSampleSize, Author, AuthorSortOrder, AuthorURL, AutoSummary, AverageLevel, BccAddresses, BccNames, Beats-per-minute, BeatsPerMinute, BillingInformation, Birthday, BitDepth, Bitrate, BroadcastDate, BusinessAddress, BusinessCity, BusinessCountry-Region, BusinessFax, BusinessHomePage, BusinessPOBox, BusinessPhone, BusinessPostalCode, BusinessStateOrProvince, BusinessStreet, BuyNow, BuyTickets, CDTrackEnabled, CallLetters, CallbackNumber, CameraMaker, CameraManufacturer, CameraModel, CarPhone, Category, CcAddresses, CcNames, CellPhone, ChannelNumber, Channels, ChapterNum, Children, City, ClientID, ClosedCaptioning, Color, Comment, Comments, Company, CompanyMainPhone, Complete, Composer, Composers, Computer, Conductor, Conductors, ContactNames, ContentDistributor, ContentDistributorDuration, ContentDistributorType, ContentGroupDescription, ContentType, Contributors, ConversationID, Copyright, Count, Country-Region, Creator, CurrentBitrate, DLNAServerUDN, DLNASourceURI, DRMIndividualizedVersion, DRMKeyID, DTCPIPHost, DTCPIPPort, DVDID, DataRate, Date, DateAccessed, DateAcquired, DateArchived, DateCompleted, DateCreated, DateImported, DateLastSaved, DateModified, DatePictureTaken, DateReceived, DateReleased, DateSent, DateVisited, Department, Description, Dimensions, Director, Directors, DisplayArtist, Division, DocumentID, DueDate, Duration, E-mail2, E-mail3, E-mailAddress, E-mailDisplayName, E-mailList, EncodedBy, EncodingTime, EndDate, EntryType, EpisodeName, Event, ExifVersion, ExposureBias, ExposureProgram, ExposureTime, F-stop, FileAs, FileCount, FileSize, FileType, FileVersion, FirstName, FlagColor, FlagStatus, FlashMode, FocalLength, FocalLength35mm, Folder, FolderName, FolderPath, FormatTag, FourCC, FrameHeight, FrameRate, FrameWidth, Free-busyStatus, Frequency, FromAddresses, FromNames, FullName, Gender, Genre, GenreID, GivenName, HasAttachments, HasFlag, Hobbies, HomeAddress, HomeCity, HomeCountry-Region, HomeFax, HomePOBox, HomePhone, HomePostalCode, HomeStateOrProvince, HomeStreet, HorizontalResolution, IMAddresses, ISOSpeed, Importance, Incomplete, InitialKey, Initials, IsAttachment, IsCompleted, IsDeleted, IsNetworkFeed, IsOnline, IsProtected, IsRecurring, IsVBR, JobTitle, Keywords, Kinds, Label, Language, LastName, LastPrinted, LeadPerformer, LegalTrademarks, LensMaker, LensModel, LibraryID, LibraryName, LightSource, LinkStatus, LinkTarget, Location, Lyrics, MCDI, MailingAddress, MaxAperture, MediaClassPrimaryID, , MediaClassSecondaryID, MediaContentTypes, MediaCreated, MediaOriginalBroadcastDateTime, MediaOriginalChannel, MediaStationName, MediaType, MeteringMode, MiddleName, Mileage, ModifiedBy, Mood, MoreInfo, Name, Nickname, OfficeLocation, OfflineAvailability, OfflineStatus, OptionalAttendeeAddresses, OptionalAttendees, OrganizerAddress, OrganizerName, Orientation, OriginalAlbumTitle, OriginalArtist, OriginalLyricist, OtherAddress, OtherCity, OtherCountry-Region, OtherPOBox, OtherPostalCode, OtherStateOrProvince, OtherStreet, Owner, POBox, Pager, Pages, ParentalRating, ParentalRatingReason, PartOfSet, Participants, Path, PeakValue, PerceivedType, Period, PersonalTitle, PixelAspectRatioX, PixelAspectRatioY, PlaylistIndex, PostalCode, PrimaryE-mail, PrimaryPhone, Priority, Producer, Producers, ProductName, ProductVersion, Profession, ProgramDescription, ProgramMode, ProgramName, Project, PromotionURL, Protected, ProtectionType, Provider, ProviderLogoURL, ProviderRating, ProviderStyle, ProviderURL, Publisher, RadioBand, RadioFormat, Rating, RatingOrg, ReadStatus, RecordingTime, RecordingTimeDay, RecordingTimeMonth, RecordingTimeYear, RecordingTimeYearMonth, RecordingTimeYearMonthDay, ReleaseDate, ReleaseDateDay, ReleaseDateMonth, ReleaseDateYear, ReleaseDateYearMonth, ReleaseDateYearMonthDay, ReminderTime, RequestState, RequiredAttendeeAddresses, RequiredAttendees, Rerun, Resources, SAP, Saturation, SearchRanking, SenderAddress, SenderName, Sensitivity, ShadowFilePath, Shared, SharedUserRating, SharedWith, Size, Slides, Source, SourceURL, SpaceFree, SpaceUsed, Spouse, StartDate, StateOrProvince, StationCallSign, StationName, Status, Store, Street, Subject, SubjectDistance, SubscriptionContentID, Subtitle, SubtitleDescription, Suffix, Summary, Sync01, Sync02, Sync03, Sync04, Sync05, Sync06, Sync07, Sync08, Sync09, Sync10, Sync11, Sync12, Sync13, Sync14, Sync15, Sync16, SyncOnly, SyncState, TTY-TTDPhone, TaskOwner, Telex, Temporary, Title, TitleNum, TitleSortOrder, ToAddresses, ToDoTitle, ToNames, TotalBitrate, TotalDuration, TotalEditingTime, TotalFileSize, TotalSize, TrackNumber, TrackingID, Type, URL, UniqueFileIdentifier, Untitled0, Untitled1, Untitled2, UserCustom1, UserCustom2, UserEffectiveRating, UserLastPlayedTime, UserPlayCount, UserPlaycountAfternoon, UserPlaycountEvening, UserPlaycountMorning, UserPlaycountNight, UserPlaycountWeekday, UserPlaycountWeekend, UserRating, UserServiceRating, UserWebURL, VerticalResolution, VideoBitrate, VideoCompression, VideoFormat, VideoFrameRate, VideoHeight, VideoWidth, WMCollectionGroupID, WMCollectionID, WMContentID, WMShadowFileSourceDRMType, WMShadowFileSourceFileType, Webpage, WhiteBalance, WindowsFileName, WordCount, Writer, Writers, Year

EXIF Image Metadata Examples:

A100DataOffset, AdventRevision, AdventScale, AFCP_IPTC, AffineTransformMat, ApertureValue, ApplicationNotes, Artist, BackgroundColorIndicator, BackgroundColorValue, BadFaxLines, BatteryLevel, BitsPerExtendedRunLength, BitsPerRunLength, BitsPerSample, BrightnessValue, CellLength, CellWidth, CFAPattern2, CFARepeatPatternDim, ChromaticAberrationCorrection, ChromaticAberrationCorrParams, CleanFaxData, ClipPath, CMYKEquivalent, CodingMethods, ColorCharacterization, ColorMap, ColorResponseUnit, ColorSequence, ColorTable, ComponentsConfiguration, CompressedBitsPerPixel, Compression, ConsecutiveBadFaxLines, Copyright, CreateDate, DataType, DateTimeOriginal, Decode, DefaultImageColor, DistortionCorrection, DistortionCorrParams, DocumentName, DotRange, ExifOffset, ExifVersion, ExposureCompensation, ExposureProgram, ExposureTime, ExtraSamples, FaxProfile, FaxRecvParams, FaxRecvTime, FaxSubAddress, FedexEDR, FillOrder, FNumber, FovCot, FreeByteCounts, FreeOffsets, GeoTiffAsciiParams, GeoTiffDirectory, GeoTiffDoubleParams, GlobalParametersIFD, GooglePlusUploadCode, GPSInfo, GrayResponseCurve, GrayResponseUnit, HalftoneHints, HCUsage, HostComputer, ICC_Profile, ImageColorIndicator, ImageColorValue, ImageDepth, ImageDescription, ImageFullHeight, ImageFullWidth, ImageHeight, ImageID, ImageLayer, ImageReferencePoints, ImageWidth, Indexed, INGRReserved, InkNames, InkSet, IntergraphFlagRegisters, IntergraphMatrix, IntergraphPacketData, Interlace, InteropIndex, InteropVersion, IPTC-NAA, ISO, ISOSpeed, ISOSpeedLatitudeyyy, ISOSpeedLatitudezzz, IT8Header, JBIGOptions, JPEGACTables, JPEGDCTables, JPEGLosslessPredictors, JPEGPointTransforms, JPEGProc, JPEGQTables, JPEGRestartInterval, JPEGTables, JpgFromRawLength, JpgFromRawStart, JPLCartoIFD, KodakIFD, LeafData, LeafSubIFD, Make, MatrixWorldToCamera, MatrixWorldToScreen, Matteing, MaxSampleValue, MDColorTable, MDFileTag, MDFileUnits, MDLabName, MDPrepDate, MDPrepTime, MDSampleInfo, MDScalePixel, MinSampleValue, Model, Model2, ModelTiePoint, ModelTransform, ModeNumber, ModifyDate, MultiProfiles, NumberofInks, OffsetTime, OffsetTimeDigitized, OffsetTimeOriginal, OldSubfileType, OPIProxy, Opto-ElectricConvFactor, Orientation, OtherImageLength, OtherImageStart, PageName, PageNumber, PhotometricInterpretation, PhotoshopSettings, PixelIntensityRange, PixelMagicJBIGOptions, PixelScale, PlanarConfiguration, Predictor, PreviewImageLength, PreviewImageStart, PrimaryChromaticities, ProcessingSoftware, ProfileType, RasterPadding, Rating, RatingPercent, RecommendedExposureIndex, ReferenceBlackWhite, RegionXformTackPoint, RelatedImageFileFormat, RelatedImageHeight, RelatedImageWidth, ResolutionUnit, RowsPerStrip, SampleFormat, SamplesPerPixel, SelfTimerMode, SEMInfo, SensitivityType, SharedData, ShutterSpeedValue, Site, SMaxSampleValue, SMinSampleValue, Software, SonyCropSize, SonyCropTopLeft, SonyRawFileType, SonyToneCurve, SpectralSensitivity, StandardOutputSensitivity, StitchInfo, StripByteCounts, StripOffsets, StripRowCounts, SubfileType, SubIFD, T4Options, T6Options, T82Options, T88Options, TargetPrinter, TextureFormat, Thresholding, ThumbnailLength, ThumbnailOffset, TIFF_FXExtensions, TileByteCounts, TileDepth, TileLength, TileOffsets, TileWidth, TimeZoneOffset, TransferFunction, TransferRange, TransparencyIndicator, TrapIndicator, UIC1Tag, UIC2Tag, UIC3Tag, UIC4Tag, USPTOMiscellaneous, VersionYear, VignettingCorrection, VignettingCorrParams, WangAnnotation, WangTag1, WangTag3, WangTag4, WarpQuadrilateral, WB_GRGBLevels, WhitePoint, WrapModes, XClipPathUnits, XP_DIP_XML, XPosition, XResolution, YCbCrCoefficients, YCbCrPositioning, YCbCrSubSampling, YClipPathUnits, YPosition, YResolution

For more information about Forensic Discovery’s Computer Forensics services, read here: https://forensicdiscovery.expert/metadata-the-attorneys-secret-weapon-in-civil-litigation/