Does metadata stay when attached to an email?

We recently received the question of whether or not file metadata stays with a file when it is emailed.

The answer is usually yes, but it can be a little more complex.

Metadata

First, metadata is the information about the file or picture that provides additional details about it.
For a picture, it would be the time the picture was taken, the geographic coordinates, and the type of camera used to take the picture. For a document, it might include who the author is or when it was last printed.

Here’s where it get’s a little complicated.

There are two types of metadata, internal and external. Internal metadata stays with the file while external metadata stays on the computer or device that created the file.

This external metadata can be helpful for your case, but it is stored wherever the file was first created. For a picture, this would be the cell phone or the camera that took the picture. For a word document, this would be the computer.

Why does this matter?

Internal metadata can be easily manipulated while external metadata is much more difficult to change. If there is any dispute about the authenticity of a digital file or picture, we want to make certain the external metadata is collected so we can validate or dispute its authenticity.
To do that, we need to collect it from the original source the file was created on, like the computer or cell phone.

So yes, internal file metadata stays with a file when it is emailed, but that doesn’t mean this metadata is authentic. The internal metadata could have been manipulated by the sender.
You don’t want to discover the evidence you’ve been relying on will later be shown to have been manipulated. Reach out to your favorite digital forensics expert and share your concerns. They’ll guide you through the steps you’ll need to take so you’re not surprised at the wrong moment.