E-Discovery – Metadata
Any complete presentation on electronic forensics should include a section on metadata. Simply put, metadata means “data about data.” The theory behind keeping metadata is that it creates a retrievable track record of authorship and changes, with tools intended to preserve for posterity the stages of development of a document or other electronic information.
There are many forms of metadata, and various levels of information storage related to metadata. Metadata represents valuable information, including exact time and dates when files were created, modified, deleted and the context of the files. It also preserves important information related to the user or users providing input or causing changes to be made to a document or file.
There is wide misconception that metadata refers to the hidden data on a computer; that is incorrect, as the data input to a metadata-equipped file actually can be reviewed by the user and others. However, the majority of laymen lack the knowledge to comprehensively view metadata. It can be difficult to understand this material without the use of specialized tools and education to accurately interpret the metadata. But it is not hidden.
There are two types of metadata
- Application metadata is embedded within a file
- System metadata is stored outside of the file and is used by a computer’s file system to track file locations and other details, such as the size of the file, the last time it was modified and who created the file.