Metadata Best Practices - Revealing the hidden information in Microsoft Word documents
by Jon Rowe.
Microsoft Word contains hidden information regarding a documents characteristics, when it was created, edited and which author modified the document. In addition to the visible text in a Microsoft Word document there is also information which isn't visible that track the document through creation and revision.
Since files are potential evidence and the timeline of events as well as what happen to the evidence is important it is easy to understand how metadata can help win or lose a case depending on whether or not the files belong to your client and what they contain.
All Microsoft Office documents contain metadata and there are dozens of other file types which also store valuable information about the file. These topics will be covered in a different article.
In a legal case many think of emails when referring to metadata. Often the fields (i.e. 'To', 'CC', 'From', 'Date Sent' etc.) are referred to as metadata. Actually, these are database fields as oppose to the hidden information in files.
One other category of metadata that is worth mentioning is file system metadata. File system metadata is different than Microsof Office metadata and is stored outside the document.
File system metadata is independent of the Microsoft Office metadata and is stored in the FAT (File Allocation Table) which is similar to a table of contents for the operating system (i.e. .Microsoft Windows).
Spoliation in a legal case often refers to files where the file system metadata has been altered during the copy process.
When computer files are copied from the custodian computer to another location during a document production file system metadata can be altered. Pinpoint Labs has created the software ?SafeCopy? so files can be copied between locations without altering metadata.
The folowing paragraph contains a list of the common metadata fields contained in a Microsof Word document.
MICROSOFT WORD METADATA FIELDS - File Name, Title, Author, Comments, App Name, Version Date, Created Date, Last Printed, Date Last Saved, Total Edit Time, Template, Shared, Subject, Category, Company, Keywords, Manager, Last Saved By, Word Count, Page Count, Paragraph Count, Line Count, Character Count, Chars, Byte Count, Presentation Format, Slide Count, Note Count, Hidden Slides, Multimedia Clips, Last 10 Authors, Routing Slip, Track Changes, Fast Saves, Hidden text, Graphics, Hyperlinks, Document Variables, Include Fields.
MetaViewer from Pinpoint Labs is a program that allows users to easily view the file system metadata and Microsoft Office metadata. MetaViewer also calculates and displays hash values for MD5, SHA-1 (SHA1) and SHA-256 (SHA256). Computer forensic examiners and litigation support professionals have found MetaViewer and valuable tool. MetaViewer can be downloaded from the Pinpoint Labs website.
About the author: Jon Rowe is the President of Pinpoint Labs and a Certified Computer Examiner. To learn more about Pinpoint Labs click here
Pinpoint Labs Website - Computer Forensics Software and Services Get your own completely
unique content version of this article.
