Does metadata stay when attached to an email?

We recently received the question of whether or not file metadata stays with a file when it is emailed.

The answer is usually yes, but it can be a little more complex.

Metadata

First, metadata is the information about the file or picture that provides additional details about it.
For a picture, it would be the time the picture was taken, the geographic coordinates, and the type of camera used to take the picture. For a document, it might include who the author is or when it was last printed.

Here’s where it get’s a little complicated.

There are two types of metadata, internal and external. Internal metadata stays with the file while external metadata stays on the computer or device that created the file.

This external metadata can be helpful for your case, but it is stored wherever the file was first created. For a picture, this would be the cell phone or the camera that took the picture. For a word document, this would be the computer.

Why does this matter?

Internal metadata can be easily manipulated while external metadata is much more difficult to change. If there is any dispute about the authenticity of a digital file or picture, we want to make certain the external metadata is collected so we can validate or dispute its authenticity.
To do that, we need to collect it from the original source the file was created on, like the computer or cell phone.

So yes, internal file metadata stays with a file when it is emailed, but that doesn’t mean this metadata is authentic. The internal metadata could have been manipulated by the sender.
You don’t want to discover the evidence you’ve been relying on will later be shown to have been manipulated. Reach out to your favorite digital forensics expert and share your concerns. They’ll guide you through the steps you’ll need to take so you’re not surprised at the wrong moment.

Contact Us:



Email Us



Phone: (855) 839-9084

#

Back to Knowledge Base

ArcherHall

How can we help?

Digital Forensics &

E-Discovery

Digital Evidence
Collection, examination, and testimony

Electronically Stored Information
Processing, production, and hosting

Contact

Give us a call at (855) 839-9084

Or send us a message and we’ll get back to you right away.

    • Digital Forensics
    • E-Discovery
    • Data Breach
    • Knowledge Base
    • MCLE Presentations
    • Pricing
    • About
    • Live Remote CLEs
    • Careers
    • Contact
    • Follow

    0 / 500

    Capitol Digital & Califorensics is now

    ArcherHall

    We are pleased to announce the new name of our company: ArcherHall. We have the same ownership, same dedicated team, and same great service that we’ve delivered for over 20 years. We look forward to continuing to work with you!

    • Home
    • Services
    • Pricing
    • Contact
    • Send Files


    855.839.9084