• United States



The Perils of Metadata

Feb 21, 20082 mins
CareersData and Information SecurityIT Leadership

I think of it as watching too much Law & Order (my favorite show!) The excitement of finding out that the contract document was actually created later then it should have been based on a date associated with a file. The author name, dates and all sorts of items are embedded in data. On its face, it can appear to solve a case but it can have its issues. Many times I have been asked to show a way to rely on metadata to prove one fact or another. While metadata, commonly referred to as data about data, can reveal information that is helpful it also can be very unreliable.

For example, files associated with dates assigned by Microsoft can contain have issues with what seems to be clear cut information. Microsoft can generate the creation dates in slightly different ways depending on how and where the file is saved. When a user opens a blank Microsoft Excel document and saves it on January 1, 2001, the created date would be January 1, 2001. However, if the user takes that same file and saves it to a new file path, a new date will be assigned – the date it was saved to the new path. Print date is a date that the application assigns every time a document is printed by a user. However, after every print operation the user must save the file to have the date updated. What if this is just one version of a document? Perhaps the original no longer exists or is stored elsewhere? On top of this all this information can be easy to alter.

In general, metadata is a valuable source of information but to jump to the conclusion the smoking gun has been found based on metadata may not be a wise choice. That being said, it can provide a strong clue about what happened and add into the facts to support a matter. Going back to Law & Order mode – consider it a great clue and go from there.

Kris Haworth is a Managing Director in the FTI Forensic and Litigation Consulting practice and is based in the San Francisco office. She focuses on computer forensics, expert testimony and electronic discovery. Ms. Haworth has more than fifteen years of professional experience in the technology industry and more than ten of years of experience in computer forensics and electronic discovery. She has provided services to Fortune 500 corporations and some of the country's most respected legal firms. She has worked on cases that have established national precedent, including Advante v. Mintel, World Courier v. Baron, In Re Verisign Securities Litigation, Playboy v. Welles and Trigon Ins. Co. v. USA. Her practices have been approved by government agencies including the FBI, FDIC, DOJ, and SEC. She focuses on large-scale electronic evidence production, internal corporate investigations and computer forensics engagements. She frequently assists clients involved in government investigations, HSR merger issues, intellectual property theft, securities investigations, and other types of class action litigation.