Metadata
Definition
Data about data. In document forensics, metadata includes file-creation timestamps, last-modified dates, author fields, revision history, and embedded GPS coordinates in images. In email forensics, metadata is the header information recording routing path and originating IP.
- Document metadata includes
- creation timestamps, last-modified dates, author fields, revision history, embedded GPS coordinates in images
- Email metadata includes
- header information, routing path, originating IP address
- Message metadata includes
- sender and recipient identifiers, timestamps, delivery and read receipts, device identifier, and sometimes geolocation data
Common questions
What information counts as metadata in digital evidence?+
Metadata is data about data. In documents it includes file creation and modification dates, author fields, revision history, and GPS coordinates from images. In emails it covers header information like sender, recipient, timestamps, and originating IP. In text messages it includes sender ID, delivery receipts, device identifier, and sometimes location data.
Why is metadata sometimes more important than the message itself?+
Message metadata like timestamps, routing information, device identifiers, and read receipts is recorded automatically and is often more reliable as legal evidence than the message body alone.
Can metadata be removed or hidden from files?+
Metadata is automatically attached to documents, emails, and messages by the system that creates them. While some metadata can be edited or stripped from files, digital forensics examines this structured information about creation, modification, routing, and delivery.
Related terms
- Chain of Custody
- The documented chronological record of who collected, handled, transferred, and examined a piece of evidence. For digital evidence, chain of custody includes...
- Audit Trail
- A log maintained by an accounting system, ERP, or cloud application recording who accessed, created, modified, or deleted each record, with timestamps....
- Code-Switching
- Shifting between different registers or even different languages within an interaction, often as a signal of role or authority. An interviewer who...
- Digital Footprint
- The cumulative set of data traces a person or entity leaves across internet-accessible sources, including domain registrations, social media posts, forum accounts,...
- Digital Written Language
- Text produced in digital communication contexts : SMS, instant messaging, social media posts, email : distinguished from formal writing by its brevity,...
- Electronically Stored Information (ESI)
- Any information created, stored, or transmitted in electronic form, including emails, database records, spreadsheets, accounting system logs, chat messages, and metadata. ESI...
- Forensic Stylometry
- The statistical analysis of textual features : function-word frequencies, sentence length distributions, punctuation patterns : to identify or compare authors. Reliable on...
- Hash Value
- A fixed-length digital fingerprint produced by running a file through a cryptographic algorithm such as SHA-256 or MD5. Identical files produce identical...
- Idiolect
- The language variety specific to an individual, comprising their characteristic vocabulary, syntactic preferences, spelling habits, punctuation patterns, and discourse-level style. Authorship attribution...
- Legal Hold
- A directive from legal counsel instructing relevant people within an organisation to preserve documents, data, and physical items that may be relevant...
- OSINT
- Open-Source Intelligence. Investigation using publicly available sources: social media, satellite imagery, news archives, public databases. In deepfake casework, OSINT corroborates or contradicts...
- Passive Collection
- OSINT collection that queries third-party databases and archived sources without sending any traffic directly to the target's systems, avoiding any trace on...
Explained in these topics
- Digital Evidence in Financial CasesData about data. In document forensics, metadata includes file-creation timestamps, last-modified dates, author fields, revision history, and embedded GPS coor...
- Text Messaging and Digital Language as EvidenceStructured data automatically attached to a message: sender identifier, recipient, timestamp, delivery and read receipts, device identifier, and sometimes geol...
- Web OSINT and Digital Footprint AnalysisData embedded within a file that describes the file itself: for images, this typically includes EXIF data such as camera model, GPS coordinates of where the ph...