Metadata
Definition
Data about data. In document forensics, metadata includes file-creation timestamps, last-modified dates, author fields, revision history, and embedded GPS coordinates in images. In email forensics, metadata is the header information recording routing path and originating IP.
- Document metadata includes
- creation timestamps, last-modified dates, author fields, revision history, embedded GPS coordinates in images
- Email metadata includes
- header information, routing path, originating IP address
- Message metadata includes
- sender and recipient identifiers, timestamps, delivery and read receipts, device identifier, and sometimes geolocation data
Common questions
What information counts as metadata in digital evidence?+
Metadata is data about data. In documents it includes file creation and modification dates, author fields, revision history, and GPS coordinates from images. In emails it covers header information like sender, recipient, timestamps, and originating IP. In text messages it includes sender ID, delivery receipts, device identifier, and sometimes location data.
Why is metadata sometimes more important than the message itself?+
Message metadata like timestamps, routing information, device identifiers, and read receipts is recorded automatically and is often more reliable as legal evidence than the message body alone.
Can metadata be removed or hidden from files?+
Metadata is automatically attached to documents, emails, and messages by the system that creates them. While some metadata can be edited or stripped from files, digital forensics examines this structured information about creation, modification, routing, and delivery.
Related terms
- Chain of custody
- The unbroken documentary trail of who held a sealed exhibit, when, and under what seal, from the moment of collection through analysis...
- Audit trail
- A log maintained by an accounting system, ERP, or cloud application recording who accessed, created, modified, or deleted each record, with timestamps....
- Code-switching
- Shifting between different registers or even different languages within an interaction, often as a signal of role or authority. An interviewer who...
- Digital written language
- Text produced in digital communication contexts : SMS, instant messaging, social media posts, email : distinguished from formal writing by its brevity,...
- Electronically stored information (ESI)
- The US legal term for any information created, stored, or communicated digitally. ESI includes emails, accounting databases, spreadsheets, instant messages, ERP records,...
- Forensic stylometry
- The statistical analysis of textual features : function-word frequencies, sentence length distributions, punctuation patterns : to identify or compare authors. Reliable on...
- Hash value
- A fixed-length digital fingerprint produced by running a file through a cryptographic algorithm such as SHA-256 or MD5. Identical files produce identical...
- Idiolect
- The language variety specific to an individual, comprising their characteristic vocabulary, syntactic preferences, spelling habits, punctuation patterns, and discourse-level style. Authorship attribution...
- Legal hold
- A directive from legal counsel instructing relevant people within an organisation to preserve documents, data, and physical items that may be relevant...
Explained in these topics
- Digital Evidence in Financial CasesData about data. In document forensics, metadata includes file-creation timestamps, last-modified dates, author fields, revision history, and embedded GPS coor...
- Text Messaging and Digital Language as EvidenceStructured data automatically attached to a message: sender identifier, recipient, timestamp, delivery and read receipts, device identifier, and sometimes geol...