Metadata Interrogation: What is it and why is it useful?

Metadata interrogation can be a vital instrument for ascertaining the authenticity of digital evidence.

Are you a solicitor acting on behalf of a client where document authenticity is being questioned? Perhaps you’re investigating a shareholder dispute, and documents have been presented that you were previously unaware of. Metadata interrogation may hold the key to resolving the matter.

What is metadata?

When an electronic document is created and stored on a digital device, ‘hidden’ intrinsic data is created. This is referred to as metadata and details information such as:

• Creation date;
• When it was last edited;
• last saved timestamps;
• File author name(s).

Metadata is a blanket term. There are many types of metadata; for example, EXIF (Exchangeable Image File) data is a type of metadata found within image files and is very useful for digital forensic analysis. When accessing documents as a normal user it is not possible to alter or ‘tamper’ with metadata. However, there are specialist tools readily available that can make this possible in the hands of someone with sufficient knowledge. When files are out of a ‘native’ environment, metadata can only be taken at face value; there is no way of determining any metadata manipulation.

Native environments for some file types are for example:

• A Microsoft Word document stored on the computer it was created on.
• An image stored on the camera device (e.g. a traditional camera or phone) it was created on, or the computer it was transferred to from the original device.

Why metadata is important

Metadata interrogation can glean specific information to further understand a timeline of events. This includes whether documents or images that reference specific events or dates have been created or edited after the fact. This can be crucial in resolving disputes of both a civil and criminal nature.

How do we assess the authenticity of the metadata?

• We are provided with the file(s) in question and granted access to a device that houses the files’ ‘native environment’;
• We forensically image a device, which creates an exact copy of all data within the said device;
• The specified files are located on the forensic image;
• Comparison between the metadata held in the native environment and the file provided to us;
• We provide a comprehensive report detailing our forensic methodology as well as our findings after the metadata interrogation. We can then conclude whether there is seemingly any evidence that the metadata has been altered or otherwise.

Construction Company Dispute

Metadata interrogation is applicable to many scenarios across all industries. Most recently, CYFOR were instructed by lawyers representing a large construction company. They required the analysis of image files to infer whether a set of photographs had been edited or are in their original state relating to a time-specific event.

Insurance Company Shareholder Dispute

We have also been instructed by a nationwide law firm acting for their client, who needed to ascertain whether a document relating to employee time logs for billable hours had been fraudulently edited after the fact.