Litigator's Guide to Metadata - Codemantra.net

More documents

Recommendations

Info

amongst the bar. But metadata is much more than simply the embedded application metadatathat affords those who know how to find it the ability to dredge up a document’s secrets.By design, application metadata is embedded in the file it describes and moves with the file whenyou copy it. However, not all metadata is embedded (for the same reason that cards in a librarycard catalog aren’t stored between the pages of the books). You have to know where theinformation resides to reach it.System MetadataUnlike books, computer files aren’t neatly bound tomes with names embossed on spines andcovers. Often, files don’t internally reflect the name they’ve been given or other information abouttheir location, history or ownership. Theinformation about the file which is notembedded within the file it describes but isstored externally is its system metadata.The computer’s file management systemuses system metadata to track filelocations and store demographics abouteach file’s name, size, creation,modification and usage.System metadata is crucial to electronicdiscovery because so much of our abilityto identify, find, sort and cull informationdepends on its system metadata values.For example, system metadata helpsidentify the custodians of files, when fileswere created or altered and the folders in which they were stored. System metadata stores muchof the who, when, where and how of electronic evidence.Every computer employs one or more databases to keep track of system metadata. In computersrunning the Windows operating system, the principal ―card catalog‖ tracking system metadata iscalled the Master File Table or ―MFT.‖ In the predecessor DOS operating system, it was calledthe File Allocation Table or ―FAT.‖ The more sophisticated and secure the operating system, thegreater the richness and complexity of the system metadata in the file table.Windows Shell ItemsIn the Windows world, Microsoft calls any single piece of content, such as a file, folder, emailmessage or contact, a ―Shell item.‖ Any individual piece of metadata associated with a Shell itemis called a ―property‖ of the item. Windows tracks 284 distinct metadata properties of Shell itemsin 28 property categories, as set out fully in Appendix B. To see the list of Shell item propertieson your own Windows system, right click on the column names in any folder view and select―More….‖ Examining just a handful of these in four key categories reveals metadata of greatpotential evidentiary value existing within and without files, messages and photos:6
CategoryDocumentMessagePhotoSystemPropertiesClientIDContributorDateCreatedDatePrintedDateSavedDocumentIDAttachmentContentsAttachmentNamesBccAddressBccNameCcAddressCcNameConversationIDConversationIndexDateReceivedDateSentFlagsCameraManufacturerCameraModelApplicationNameAuthorCommentCompanyComputerNameContainedItemsContentTypeDateAccessedDateAcquiredDateArchivedDateCompletedDateCreatedDateImportedDateModifiedDueDateEndDateFileAttributesFileCountFileDescriptionFileExtensionFileNameIsSharedLastAuthorRevisionNumberTemplateTotalEditingTimeVersionFromAddressFromNameHasAttachmentsIsFwdOrReplySenderAddressSenderNameStoreToAddressToDoFlagsToDoTitleToNameCameraSerialNumberDateTakenItemAuthorsItemDateItemFolderNameDisplayItemFolderPathDisplayItemNameOriginalFileNameOwnerSIDProjectSensitivitySensitivityTextSharedWithSizeStatusSubjectTitleFileOwnerFlagStatusFullTextIsAttachmentIsDeletedIsEncryptedMuch More MetadataThe 284 Windows Shell item properties are by no means an exhaustive list of metadata. Softwareapplications deploy their own complements of metadata geared to supporting features unique toeach application. E-mail software, word processing applications and spreadsheet, database, webbrowser and presentation software collectively employ hundreds of additional fields of metadata.7
Page 3: A lawyer’s ability to advise a cl
Page 9 and 10: from field to field or application
Page 11 and 12: time in military and aviation circl
Page 13 and 14: yet least helpful. Last accessed da
Page 15 and 16: Evaluate Need and Methods for Prese
Page 17 and 18: work. In general, the richer the in
Page 19 and 20: Appendix A: Just Ones and ZeroesThe
Page 21 and 22: 21HomeAddressStreetHomeFaxNumberWeb
Page 23 and 24: 23MessageAttachmentContentsAttachme
Page 25 and 26: 25TargetSFGAOFlagsStringsSoftwareAp
Page 27 and 28: Appendix C: Outlook Standard Proper
Page 29 and 30: permits or requires conversion, or
Page 31 and 32: ii. Attachments to e-mails need not
Page 33 and 34: however, if it is extracted, it mus
Page 35 and 36: agreement does not relieve those pa

Litigator's Guide to Metadata - Codemantra.net

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?