Metadata describes the data behind the data. It can be hugely beneficial to legal professionals to paint a digital timeline of events.
When proving the credibility of digital evidence, metadata can be crucial. Knowing what it is and its uses in court can be the difference between winning or losing a case.
- How reliable is metadata?
- Can metadata be wrong?
- Can metadata be used as evidence?
- What can metadata be used for? How metadata is used in digital forensics and in court
How reliable is metadata?
In litigation, metadata is evidence that describes the characteristics, origins, usage and validity of electronic evidence. Metadata attaches to electronically stored information (ESI), making it useful for legal professionals to figure out the who, what, when and where of files.
Critical information revealed by metadata can consist of author identity, file date creation and previous access to the file. You can use this digital footprint to see who’s been responsible for the creation or modification of ESI. Therefore, metadata can be relied upon to prove the credibility of evidence, strengthening your case in the process.
Can metadata be misleading?
Metadata can be the difference between winning or losing a modern case. That’s why it’s vital to spot metadata anomalies. However, this can be highly complicated. Any inconsistency in metadata could lead to accusations of data tampering and would put your case in a challenging position.
Organisations can turn to automation to thoroughly examine their data quickly. In some enterprise environments, advanced tools can comb through the data and point teams towards what needs to be fixed. Automated tools highlight which metadata is not consistent across the databases. With consistent filing, discrepancies are less common and metadata retains its validity.
It’s the organisation's responsibility to maintain this. If a company is being sued or discovery has already begun, it’ll be too late for them to fix their metadata.
It’s important to note that metadata can be wrong – but not always in a malicious way. For example, if a colleague were to make a copy of a document, the metadata would show a created date of when the copy was made, and not that of the original document.
If documents like this were to be brought into eDiscovery, they would appear as duplicates, as most platforms don’t measure file system metadata when running de-duplication algorithms. They do tend to store information from any duplicate documents found, however. Of course, metadata can also be deliberately spoliated.
Can metadata be used as evidence?
Metadata can often count as substantial evidence in modern cases. As it attaches itself to all electronic files, it leaves information that can be cross-referenced with a claim or defence. Alongside this, missing metadata can also be considered evidence. ESI without metadata is incomplete and indicates that a file may have been tampered with. Missing metadata could prove to a jury that evidence has been altered or falsified.
Without metadata, you’d have to authenticate ESI based on testimony, which can provide huge challenges in modern cases. While some metadata is readily available and easy to access, other metadata requires complex methods such as forensics and eDiscovery software to view.
What can metadata be used for? How metadata is used in digital forensics and in court
The key role of metadata in litigation is to prove the credibility of ESI. Modern cases rely heavily on data; therefore metadata can be vital in litigation. You can use metadata — such as file creation date — to prove or disprove a claim's validity.
A good example would be a doctor claiming they updated a record immediately after a medical process. However, the metadata shows they had not updated the file until a week later. Digital photographs can also contain GPS coordinates within their metadata, proving where someone took a photo.
Metadata's use in forensics
The main use of metadata for digital forensic teams is to build an electronic timeline of events. Forensic teams can align the metadata they analyse with a claim or defence by accessing information such as file creation and modification dates.
How an individual has interacted with a file can be pivotal evidence in a modern case, as metadata can allow forensic teams to understand the history of ESI.
Examples of metadata that forensic teams might be interested in are:
- Recovery of file names and their modification/access dates
- The information stored within a document or file
- Hidden document information
- A history of the number of writes/reads of records
Much like physical evidence, digital evidence must be treated with care. Digital traces are fragile and need to be adequately preserved after analysis.
Become an eDiscovery expert with our Content Hub
Our Content Hub gives you free, unlimited access to our wide range of educational resources, including eBooks, guides and more.
Simply sign up to earn lifetime access and take your eDiscovery learnings to the next level. Ready? Get started below.
