resources 9 Primers 9 Metadata: A Primer
laptop

Metadata: A Primer

Useful information for searching, authenticating, and tracking data.

Metadata is data that provides information about other data. For example: the text of a Word document is data; the information about who authored the document and when it was created is metadata. In a lawsuit or an investigation, the metadata can be at least as important as the data itself.

Although metadata exists for all types of information, it is especially important for digital information, where it can make large volumes of data much easier to use. This is particularly true in litigation, because metadata is the core of most digital forensics and e-discovery processes.

There are infinite types of metadata. Some are very common and useful in nearly every case; some are obscure but critical in certain circumstances. The types of metadata can be divided into three main categories.

Descriptive Metadata


This is the most commonly used metadata in litigation and includes Title, Author, Subject, Date and similar information about the data or document. This metadata is convenient because it frequently is human-readable (as opposed to some types of metadata which are only meaningful to a computer). There are standardized fields that are tracked for the most common types of data. For example, email metadata includes Date, Subject, Sender, and Recipient, although it may include many other potential pieces of metadata such as Bcc Recipients, or Read Date.

Descriptive metadata is essential for culling a large set of documents down to a manageable number for keyword searches or review, based on the relevant dates and custodians. Some descriptive metadata, such as hash values, can also be used to authenticate or compare documents.

Administrative Metadata


Administrative metadata includes information useful for management of data, such as file system details. A common type of administrative metadata is MAC time; this metadata shows when a file was modified, accessed, or created, and can be valuable information in an investigation. It reveals details about the history of a file, which can help establish or challenge authenticity or determine a certain user’s activities.

Structural Metadata


Structural metadata describes how discrete units of data relate to each other. Bates numbers are a common example found in litigation. These numbers don’t describe the data but instead express how the data relate to each other, such as the order of the pages and which documents are part of which production.

Related Articles

Accessing Evidence From Windows Prefetch

Accessing Evidence From Windows Prefetch

Windows Prefetch Accessing Prefetch Files for Forensic Analysis. A digital forensic investigation often aims to determine the activities of a user on a computer. Prefetch files are an important type...

read more
Collecting from Office 365

Collecting from Office 365

Collecting from Office 365 Office 365 offers eDiscovery and searching within the platform, for administrators or any authorized users to run searches and review/monitor user activity.Content Search...

read more

Contact

Give us a call at (855) 839-9084

Or send us a message and we’ll get back to you right away.