Microsoft Office documents can contain a siginificant amount of data about a file referred to as Metadata. Metadata is stored within the file and the information when analyzed can be very useful in forensic examinations and electronic discovery. The area of the file referred to as 'Last 10 Authors' is also called metadata, however, it isn't contained in the same area or accessible through the same applications as the other metadata fields. The last 10 authors/locations information can greatly assist computer forensic examinations and electronic discovery projects, however, it is important to know which software tools can access and scrub the last 10 authors information. A common assumption amongst litigation support professionals and attorneys is that last 10 authors will be extracted during an electronic discovery process. In fact, last 10 authors isn't included in the OLE stream metadata and is not extracted by common electronic discovery products or vendors. OLE stream metadata is what is visibile and often extracted through computer forensics, electronic discovery and several free utilities. Microsoft provides a dll library to allow software developers to easily access dozens of metadata fields (i.e. Title, Author, Date Last Printed, Date Last Saved etc.), however, the dll and other metadata libraries (as well as scrubbing utilities) don't provide access to the last 10 authors information. Once an attorney realizes what information can be available from last 10 authors and locations they can be elated or very concerned depending on who they are representing. It is of additional concern when attorneys realized their scrubbing software or vendor didn't remove this information. In a recent computer examination I was examining a USB drive which contained the current working files of the suspect. We were also provided access to a laptop which the suspect claimed was the only computer used in addition to the office computer. We suspected that due to the age of the laptop and that there was very little information on the computer that the suspect provided us with a computer that had been retired and wasn't in use as stated. We were able to confirm our suspicions on this case using the last 10 author data from several Microsoft Word files on the USB drive that the suspect used to store their working files. We were also able to identify two other computers that the suspect was using to create and edit files which were never examined or produced in the case. It is important to also understand that the last 10 authors data is not only captured when a user clicks 'save' but Microsoft Word's autosave feature will intermintently save files and store the information in last 10 authors. There are dozens of examples like this where last 10 authors 'metadata' can be used to help with a conviction or judgement. Informaiton can work for or against an individual and their legal representation. When it is determined that metadata is priveledge information or for any reason should be excluded, don't forget about last 10 authors. When selecting a vendor or software to scrub documents it is important to insure that the last 10 authors is removed during scrubbing. Not all vendors or software applications will identify and remove the last 10 authors data. In closing, metadata is valuable information that can help establish evidence timelines, file location and dozens of other facts related to a case. The last 10 authors metadata is extremely valuable but not easily accessible to common computer forensic and electronic discovery processes. Make sure you incorporate last 10 authors in your next project. Pinpoint Labs offers MetaViewer and MetaDiscover software tools as well as metadata consulting services.
Article Source: http://www.articlecontentprovider.com/articlesubmit
Microsoft Office documents can contain a siginificant amount of data about a file referred to as Metadata. Metadata is stored within the file and the information when analyzed can be very useful in forensic examinations and electronic discovery.
Pinpoint Metaviewer and MetaDiscover are available from Pinpoint Labs websiteMetadata Tools - Last 10 Authors Feel free to grab a unique version of this article from the Unique Articles Submission Service
Please Rate this Article
5 out of 5 4 out of 5 3 out of 5 2 out of 5 1 out of 5
