Litigator's Guide to Metadata - Codemantra.net

For example, digital photographs can carry dozens of embeddedfields of metadata detailing information about the date and time thephoto was taken, the camera, settings, exposure, lighting, evenprecise geolocation data. Many are surprised to learn that photostaken with cell phones having GPS capabilities (like the AppleiPhone) contain detailed information about where the photo wastaken to a precision of about ten meters.Photos taken with cellphones having GPScapabilities…containdetailed informationabout where the photowas taken.The popular Microsoft Outlook e-mail client application provides for more than 180 standardapplication metadata fields which users may select to customize their view. These are set outfully in Appendix C.But even this broad swath of metadata is still only part of the probative information aboutinformation recorded by computers. Within the Master File Table and index records used byWindows to track all files, still more attributes are encoded in hexadecimal notation. In fact, anironic aspect of Windows is that the record used to track information about a file may be largerthan the file itself! Stored within the hives of the System Registry—the ―Big Brother‖ database thattracks attributes covering almost any aspect of the system—are thousands upon thousands ofattribute values called ―registry keys.‖ Other records and logs track network activity and journalvirtually every action.Matryoshka MetadataMatryoshka are carved, cylindrical Russian dolls that nest inside one another. It’s helpful to thinkof computer data the same way. If the evidence of interest is a Word document attached to an e-mail, the document has its usual complement of application metadata that moves with the file; but,as it nests within an e-mail message, its ―system‖ metadata is only that which is contained withinthe transporting message. The transporting message, in turn, carries its own metadataconcerning transit, addressing, structure, encoding and the like. The message is managed byOutlook, which maintains a rich complement of metadata about the message and about its ownconfiguration. As configured, Outlook may store all messages and application metadata in acontainer file called Outlook.PST. This container fileexists within a file system of a computer that storessystem metadata about the container file, such aswhere the file is stored, under whose user account,when it was last modified, its size, name, associatedapplication and so on.Within this Matryoshka maelstrom of metadata,some information is readily accessible andcomprehensible while other data is so Byzantine andcryptic as to cause even highly skilled computerforensic examiners to scratch their heads.Forms of MetadataNow that your head is spinning from all the types, purposes and sources of metadata, let’s addanother complexity concern: the form of the metadata. Metadata aren’t presented the same way8