Microsoft Office Metadata - What every attorney should know about the hidden information in their client’s documents

Microsoft Word contains hidden information regarding a documents characteristics, when it was created, edited and which author modified the document. In addition to the visible text in a Microsoft Word document there is also information which isn't visible that track the document through creation and revision.

It is easy to understand that during a computer forensic exam or the discovery phase of a litigation metadata can play an important role. Metadata can assist with an evidence timeline and identify those who touched the evidence.

All Microsoft Office documents contain metadata and there are dozens of other file types which also store valuable information about the file. These topics will be covered in a different article.

In a legal case many think of emails when referring to metadata. Often the fields (i.e. 'To', 'CC', 'From', 'Date Sent' etc.) are referred to as metadata. Actually, these are database fields as oppose to the hidden information in files.

In addtion to Microsoft office Word metadata there is file system metadata. File system metadata is stored outside of the Microsoft Word.

The date, time, size and other information displayed in Microsoft Windows is referred to the file system metadata and is store in the File Allocation Table (FAT).

File system metadata is relevant for a different reason. Spoliation often refers to the improper collection of electronic files when the file system metadata is altered during collection.

When computer files are copied from the custodian computer to another location during a document production file system metadata can be altered. Pinpoint Labs has created the software ‘SafeCopy’ so files can be copied between locations without altering metadata.

The folowing paragraph contains a list of the common metadata fields contained in a Microsof Word document.

MICROSOFT WORD METADATA FIELDS- Last Saved By, Word Count, Page Count, Paragraph Count, Line Count, Character Count, Chars, Byte Count, Presentation Format, Slide CountNote Count, Hidden Slides, Multimedia Clips, Last 10 Authors, Routing SlipTrack Changes, Fast Saves, Hidden text, Graphics Hyperlinks, Document Variables, Include Fields, File Name, Title, Author, Comments, App Name, Version Date, Created Date, Last Printed, Date Last Saved, Total Edit Time, Template, Shared, Subject, Category, Company, Keywords, Manager.

MetaViewer from Pinpoint Labs is a program that allows users to easily view the file system metadata and Microsoft Office metadata. MetaViewer also calculates and displays hash values for MD5, SHA-1 (SHA1) and SHA-256 (SHA256). Computer forensic examiners and litigation support professionals have found MetaViewer and valuable tool. MetaViewer can be downloaded from the Pinpoint Labs website.

Article Source: http://www.approvedarticles.com

Please Rate this Article

5 out of 54 out of 53 out of 52 out of 51 out of 5 

# of Ratings = 2 | Rating = 4.5/5