PARALEGAL POWER BREAKWhat You Need to Know About Metadata

E-Discovery: An Introduction to Digital Evidence

2

TYPES OF DIGITAL EVIDENCE▪ Types of digital evidence includes:

▪ DVDs, audiotapes, phone SIM cards, memory sticks, and more

▪ Almost anything - even a refrigerator - can contain digital evidence

▪ Data: actual information being retrieved, such as a letter or document

▪ Metadata: information about the data▪ Metadata in a picture file can tell investigators the type of camera used, date of

photo, and GPS coordinates where the photo was taken

E-Discovery: An Introduction to Digital Evidence

3

Figure 1-2 Data and metadata

E-Discovery: An Introduction to Digital Evidence

4

TYPES OF DIGITAL EVIDENCE▪ To access a photo’s metadata:

▪ Open Windows Explorer

▪ Right-click the photo file and click Properties

▪ Click the Details tab

Figure 1-3 Photo metadata in the Properties dialog box

E-Discovery: An Introduction to Digital Evidence

5

TYPES OF DIGITAL EVIDENCE▪ Metadata is also available for documents

▪ An investigator can see how long the person had the document open, how many words and characters are in the document, and more

▪ Metadata has to be handled carefully

▪ Recent court cases have cited or fined companies for deleting metadata

▪ However, including metadata showing who worked on a particular file might violate other standards▪ Such as privacy regulations and copyright infringement

E-Discovery: An Introduction to Digital Evidence

6

OVERVIEW OF METADATA IN E-DISCOVERY▪ Metadata Encoding and Transmission Standard (METS) - the standard

used for objects in a digital library▪ Developed by the Digital Library Association and maintained by the Library of

Congress

▪ METS profiles are found in:▪ PDF files

▪ Photographs

▪ CDs

▪ Other digital records

E-Discovery: An Introduction to Digital Evidence

7

OVERVIEW OF METADATA IN E-DISCOVERY▪ METS has five categories for metadata:▪ Descriptive metadata - lists metadata embedded in the document or

external descriptive metadata stored on an Internet server▪ Administrative metadata - describes how a document was created and

stored, the original source object, and intellectual property rights▪ File groups - groups electronic versions of a file, such as TIF versions,

PDF versions, etc▪ Structural map - shows users how to navigate all files▪ Behavior - deals with any executable portions of documents

E-Discovery: An Introduction to Digital Evidence

8

OVERVIEW OF METADATA IN E-DISCOVERY▪ OS metadata is what is stored by computer and network operating

systems▪ A typical OS keeps track of a file’s MAC times

▪ Show when the data was modified, accessed, and created

▪ Both an OS and NOS can show investigators the last time a file was accessed and whose login was used to modify a file

▪ In civil cases▪ Only the metadata embedded in documents is captured (not the OS or NOS

metadata)

E-Discovery: An Introduction to Digital Evidence

9

OVERVIEW OF METADATA IN E-DISCOVERY▪ Metadata is used mainly for organizing the discovery process

▪ Content of documents and e-mails is more important than the metadata

▪ Deleted information might be deemed “not readily accessible” or too costly to retrieve▪ It is most likely not produced

▪ What’s used in e-discovery is metadata embedded in documents▪ Which stores information such as author and application used to create it

CONTACT USwww.rainmakersonline.cominfo@rainmakersonline.com800-580-6068

To learn more about eDiscovery purchase the text eDiscovery: An Introduction to Digital Evidence from Cengage Learning