by Anthony Wright
When it comes to litigation, attorneys are aware that metadata, or data about data, is collected with electronically stored information and that it can be used to support the data. Now, more lawyers are getting savvier with metadata – harnessing the power of that detailed information and using it to win a case.
When metadata has been forensically analyzed, it can yield fruitful information, such as document history and revision timelines, and can be used to show a person’s knowledge and intent.
Metadata can show if someone has accessed a file, how often and when it was looked at, if it was modified and how, if it was saved as a new version and more. While this kind of embedded document metadata is common these days, forensic analysis of files can include many more fields – into the hundreds – as well as file logs and histories. The results from this kind of analysis can be used to recover temporary versions of documents that were thought to be deleted or, thanks to mobile devices, provide information about the location(s) where the file was created or accessed. A forensic specialist can understand the metadata in context and point to fact-specific activities that occurred, providing strong circumstantial evidence to support a case.
In addition to embedded metadata that is contained within files themselves, file systems also have metadata in that they track when a file was created, accessed and modified. For example, by examining a computer’s file system metadata and other activity artifacts, we could show that “Mark” accessed a computer at 11:22 and logged off at 11:39. The file system’s metadata could show that a flash drive was connected to that computer at 11:24 and removed at 11:38. And it could show that certain files were accessed from an external device between 11:25 to 11:37. This is circumstantial evidence that Mark copied files to the flash drive from that computer during that time. And it is a result of the system’s metadata and access logs having changed, even though the file-based metadata did not. For example, you can view the metadata of a Word document by clicking the “File” header and then selecting “Info” on the top left; the created date would not change when you move the file to an external drive or server, but the file system created date will change to when the move occurred.
Federal Rule of Civil Procedure 34(b)(2)(E)(ii) notes that “if a request does not specify a form for producing electronically stored information, a party must produce it in a form or forms in which it is ordinarily maintained or in a reasonably usable form or forms.” This means that the party could give you files as tiffs or PDFs, which is typical, but they would not include the documents’ rich metadata. In certain scenarios, it can be good to specifically request native files so you have the detailed information that could provide the smoking gun.
Once you have the metadata, it’s important to understand what filtering strategies could do to it. For example, the date filtering tool could miss certain digital files due to differences between the file’s embedded metadata and its file system timestamp metadata. Let’s say Sally creates a file on Sept. 14 and works in that file until Nov. 2. When she knows she is done using that file, she copies it to the company server on Jan. 1 and deletes the original from her computer. If a search request comes through that next April requesting all files created the year prior, this document will not be included in the results. The copy on the server will show a creation date of Jan. 1, so that document may be completely overlooked, even though its contents could be material to the case. The good news is that newer tools are addressing these kinds of filtering flaws. It is also important to configure filtering tools to take into account document embedded metadata, which, as our examples above show, can often be different from file system metadata.
As attorneys more fully grasp the value of metadata and how they can use its information, they will be able to make more intelligent decisions about their cases’ electronic documents. You may not need to access metadata for every matter, but it’s important to be in the habit of asking for the native files so you have that information at your fingertips when you need it.