Whether you are a computer forensics examiner or a litigation support professional you should be aware of the hidden information inside Microsoft Word documents. Metadata is hidden data which reveals when a document was created, saved, printed, last 10 authors/locations and several other characteristics. Since files are potential evidence and the timeline of events as well as what happen to the evidence is important it is easy to understand how metadata can help win or lose a case depending on whether or not the files belong to your client and what they contain. Several file types contain metadata; however, the topic of this paper is to understand how Microsoft Office metadata is relevant to a civil litigation. Now, you may ask what about email ‘metadata’? In a legal case many think of emails when referring to metadata. Often the fields (i.e. 'To', 'CC', 'From', 'Date Sent' etc.) are referred to as metadata. Actually, these are database fields as oppose to the hidden information in files. WHAT IS FILE SYSTEM METADATA? - Before we discuss the internal metadata of Microsoft Office documents it is important to understand there is also file system metadata associated with Microsoft Office documents. The date, time, size and other information displayed in Microsoft Windows is referred to the file system metadata and is store in the File Allocation Table (FAT). File system metadata is relevant for a different reason. Spoliation often refers to the improper collection of electronic files when the file system metadata is altered during collection. When computer files are copied from the custodian computer to another location during a document production file system metadata can be altered. Pinpoint Labs has created the software ‘SafeCopy’ so files can be copied between locations without altering metadata. The folowing paragraph contains a list of the common metadata fields contained in a Microsof Word document. MICROSOFT WORD METADATA FIELDS- Last Saved By, Word Count, Page Count, Paragraph Count, Line Count, Character Count, Chars, Byte Count, Presentation Format, Slide CountNote Count, Hidden Slides, Multimedia Clips, Last 10 Authors, Routing SlipTrack Changes, Fast Saves, Hidden text, Graphics Hyperlinks, Document Variables, Include Fields, File Name, Title, Author, Comments, App Name, Version Date, Created Date, Last Printed, Date Last Saved, Total Edit Time, Template, Shared, Subject, Category, Company, Keywords, Manager. Pinpoint Labs developed a free tool called Metaviewer which displays both the file system metadata and internal metadata for several file types. Metaviewer also calculates hash values for MD5, SHA-1 and SHA-256. Metaviewer is a great tool for forensic examiners and litigation support professionals. You can download a free copy of Metaviewer from Pinpoint Labs website.
Article Source: http://www.articlecontentprovider.com/articlesubmit
Whether you are a computer forensics examiner or a litigation support professional you should be aware of the hidden information inside Microsoft Word documents. Metadata is hidden data which reveals when a document was created, saved, printed, last 10 authors/locations and several other characteristics.
About the author: Jon Rowe is the President of Pinpoint Labs and a Certified Computer Examiner. To learn more about Pinpoint Labs click herePinpoint Labs Website - Computer Forensics Software and Services Click here to get your own unique version of this article: Uber Articles directory.
Please Rate this Article
5 out of 5 4 out of 5 3 out of 5 2 out of 5 1 out of 5
