Microsoft Word contains hidden information regarding a documents characteristics, when it was created, edited and which author modified the document. In addition to the visible text in a Microsoft Word document there is also information which isn't visible that track the document through creation and revision.
In a legal matter electronic files are considered evidence. It would stand to reason that metadata in Microsoft Word files is important since it can explain the timeline of events and other details related to the evidence.
There are many file types which contain metadata, however, in this article we are going to primarily focus on Microsoft Word documents.
Many people think of emails when metadata is mentioned. It is important to note that the fields in an email (i.e. 'To', 'From', 'Subject' etc.) are actually database fields and not the same as the hidden information contained in other file types.
One other category of metadata that is worth mentioning is file system metadata. File system metadata is different than Microsof Office metadata and is stored outside the document.
The date, time, size and other information displayed in Microsoft Windows is referred to the file system metadata and is store in the File Allocation Table (FAT).
File system metadata is relevant for a different reason. Spoliation often refers to the improper collection of electronic files when the file system metadata is altered during collection.
When computer files are copied from the custodian computer to another location during a document production file system metadata can be altered. Pinpoint Labs has created the software ‘SafeCopy’ so files can be copied between locations without altering metadata.
The following list represents a collection of the hidden information in a Microsoft Word document:
MICROSOFT WORD METADATA FIELDS- File Name, Title, Author, Comments, App Name, Version Date, Created Date, Last Printed, Date Last Saved, Total Edit Time, Template, Shared, Subject, Category, Company, Keywords, Manager, Last Saved By, Word Count,Routing SlipTrack Changes, Fast Saves, Hidden text, Graphics Hyperlinks, Document Variables, Include Fields, Page Count, Paragraph Count, Line Count, Character Count, Chars, Byte Count, Presentation Format, Slide CountNote Count, Hidden Slides, Multimedia Clips, Last 10 Authors.
Pinpoint Labs developed a free tool called Metaviewer which displays both the file system metadata and internal metadata for several file types. Metaviewer also calculates hash values for MD5, SHA-1 and SHA-256. Metaviewer is a great tool for forensic examiners and litigation support professionals. You can download a free copy of Metaviewer from Pinpoint Labs website.
About the author: Jon Rowe is the President of Pinpoint Labs and a Certified Computer Examiner. To learn more about Pinpoint Labs click herePinpoint Labs Website - Computer Forensics Software and Services
Subscribe to:
Post Comments (Atom)
No comments:
Post a Comment