Metadata – What is it and why should you care

Many people have no idea what metadata is, why it matters, or what is can do in the real world. In it’s simplest form, metadata is the information about a computer file. Now, it is not the content of the file, say your recipe list in a Word document.

Metadata is the information you cannot see. The hidden information that most people did not even know exists. This information can send you to jail, or keep you out of jail. This information is part of every single electronic file created on a computer. Every single file has metadata.

Metadata is captured at the time the file is created. Things like the username who created the file, the time or date the file was created, or if the file has been printed. All of this and much, much more is a part of every file that is created.

Being involved with the legal industry has allowed me to see, close up, the effect metadata can have in a legal case. Legal teams can use metadata to establish a timeline of facts. Being able to accurately determine when an email was sent may be the smoking gun that destroys an alibi or establishes one in a criminal matter. In civil cases, metadata is just as important for many reasons. The ability to search and find data quickly and efficiently has been the biggest boon to attorneys in my opinion. Imagine having to still go through boxes of paper with no definitive knowledge of when it was created.

Types of Metadata

• Descriptive – these include title, subject, genre, author, and creation date, for example.
• Structural – shows how information is put together (page order to chapters, for example).
• Administrative – showing such information as when and how the resource was created. Two types of administrative metadata are those that deal with intellectual property rights and preservation metadata.
• Statistical – also called process data, this may describe processes that collect, process, or produce statistical data.

Never trust a computer you can’t throw out a window.

Steve Wozniak

The Bad News

Now comes the bad news. Metadata can be edited or even removed from a file with a metadata scrubber. While most users are not aware of this capability, many IT professionals are well aware that this exists. If you have ever watched CSI on TV you may have seen someone ask “if the timestamp has been altered” on a video or picture. This is an example of metadata at work. Time stamps are notoriously bad for being able to be changed.

When an attorney wants to use time-stamp metadata in court, they will want to ensure that the police seized the original digital camera that took the pictures. They can then argue the pictures on the camera haven’t been modified if the internal clocks match the pictures. They can also show that the clock inside the camera wasn’t set incorrectly. He can also try to corroborate the time stamps with the images themselves by using an object in the image itself like a watch or clock on a wall.