CLPEX Chat Board

With agencies going digital with their comparison notes, reports, etc... how many people (if any) are paying attention to metadata in their document files?

Reading the most recent Bullseye Blog, the topic of metadata in Word files is discussed.

Our office uses a case management system based on MS Access. Our notes are done in Excel, with the data pulled from the Access database. The template used was authored by one of our LPE's. If I check the properties of the files, the Details tab includes the "Author" as that examiner with me being the person listed as "Last saved by." Also, the "Content created" is dated several years ago. It also shows when it was "Last printed" as well as "Date last saved." This could all be explained if necessary.

But what about using MS Word, with revision history, notes, etc... all being part of the file?

Has any of this ever been brought up before?
Maybe Lisa Steele can chime in from a lawyers perspective on file metadata.

Metadata is something attorneys are told to look for, particularly regarding digital images, to figure out what changes, if any, have been made. How many attorneys or hired experts do look at the metadata absent some warning flag of a problem -- hard to say.

I work in appeals, so this is more a theoretical issue for me -- and a practical one when it comes to sharing model motions or letters to make sure there's no hidden client data.

A lot of our templates (made in Word) were created several years ago by an employee. Since then, the content of the form(s) has changed significantly (including the title or purpose of the document) but the metadata is still the same. I don't think this would ever be an issue but should it come up, I think we'd be able to explain it. Those things in the metadata are just for form creation; they are not indicative of what information the report contains. Think about a paper copy versus the digital; no one would know or likely care about who created the form--only what was on the form. Analogous to no one cares who created the front page layout of the local paper; what's important are the articles and pictures contained within.

Digital images, however, are a different story (and we all know and understand why).

Great question Steve. I recently took a computer forensics course from X-Ways, and we discussed in that class a lot about metadata related to documents that are not photos or videos.

Since we're used to looking at photos and videos, we're used to thinking about all of the metadata that is held within the document itself. In computer forensics, they also look at metadata contained in the file system that is separate from the file itself. The created, modified, and accessed dates for any file will be part of the file system. And, as we know from photographs, sometimes these dates can be different - for instance the date created that is recorded in the file system can often be more recent than what the file's internal metadata indicates (this is because the file system gives a new create date if you move a file from one drive to another, and can result in create dates that are more recent than the modify dates, etc.).

I've been playing with PDF files recently, attempting to learn what I can by analyzing them with computer forensics tools and hex editors, looking at their internal and external metadata to attempt to determine what changes have been made to them over time. This seems like a ripe field for questioned document examiners, but those I know have little information.

Back to your point. I think it's important for all of us to have some level of understanding about our file metadata - whether regarding images or forms and reports. And, we should have some understanding of both the file's internal metadata and the file system's metadata. Of course, if I get asked about this on the stand, and don't know the answers, my hope is that a computer forensics expert will be questioned who can explain it. But, having some understanding is definitely helpful!

Another important issue with metadata (especially in images) is that some of that information can be faked.

1) Take a picture on Christmas morning of yourself in front of Times Square.
2) Take a picture on Easter of yourself in front of Disneyland.
3) Open both images in Photoshop.
4) Copy the Easter image and Paste over top of the Christmas image.
5) Save the new Christmas image.

While there usually is a record that the file was opened, accessed, and saved at a later date, the image metadata would not change. The date the picture was taken, any camera information, and any geographical coordinates would now show that you were in front of Disneyland on Christmas.