Electronic Evidence Newsletters

Printable Version

Introduction to Metadata
Andrew Szczech, Electronic Evidence Consultant, Kroll Ontrack

Reflecting modern changes in today’s high-tech culture and language, the word “metadata” was recently added as an official entry in the English dictionary . The latest edition of Merriam-Webster's Collegiate Dictionary defines “metadata” as “data that provide information about other data.” The dictionary is not the only source to recognise the importance of metadata. The current legal climate reflects a trend toward requiring lawyers to review and produce metadata in litigation.

In one of the most significant developments affecting electronic evidence in U.K. cases, the Practice Direction to Civil Procedure Rule 31 was recently amended to specifically include metadata, in relation to the definition of an electronic document. The amended Practice Direction requires lawyers to realise that metadata can provide key pieces of relevant evidence and information about a particular email, spreadsheet or other electronic document.

Defining Metadata
Metadata exists behind the scenes in virtually every electronic document and includes information about who created the document, the date it was created, when it was last modified, and more. For example, in an email, metadata header information would likely include an email’s author, the list of the addressees, and the date it was sent. The availability of metadata depends on the properties of the file type (i.e., Microsoft Office documents, Word-Perfect documents, some graphics files). Depending on the type of application, a single document has the potential of having hundreds of metadata fields.

Knowing what information can be gleaned from a particular file can give lawyers the technical edge, particularly when navigating the challenges metadata poses in the review and production of electronic documents. In a case where metadata production is required, a litigation team will typically gather two primary types of file metadata during data-processing:

• File-system information - data stored independent of the file itself which contains information about the file (i.e., file names, dates, path locations, sizes).

• Internal email and file metadata information - data stored within the file itself that varies depending on the type of file in question ( i.e. , tracked changes, document versions, hidden text, macros).

Like other forms of electronic evidence, metadata can be easily altered if proper preservation precautions are not taken. In addition, every file and application will have its own set of metadata information unique to that file type. Lawyers will need to understand that defining what metadata fields they need to preserve and eventually produce is an important first step in establishing the scope of the electronic disclosure exercise. In some cases this may mean seeking the opposing party or court’s assistance in clarifying what metadata fields are relevant in the case.

Planning Ahead: Key Questions to Ask about Metadata
As technology continues to evolve, lawyers must be aware of their changing obligations. The changes to the Practice Direction for CPR Rule 31 make it clear that metadata is included as a matter of course in the definition of an electronic document . Identifying potential forms of metadata is, however, only the first step. More advanced issues that litigators face relating to metadata include:

• How do you properly preserve metadata and avoid spoliation?
• How can metadata be used as a tool for filtering a large volume of data down to a more manageable set for review?
• How do you search metadata information when reviewing documents for relevance?
• What are the concerns associated with handling metadata when producing tiff images, native files, or printed documents?

Keeping an eye on further developments addressed in this dynamic area of electronic evidence, will put lawyers in the best position to ensure disclosure compliance and avoid spoliation allegations for failing to properly handle metadata.

	Electronic Disclosure			Computer Forensics			Courtroom Services
	Learn how to efficiently manage large volumes of electronic information and quickly find evidence. Electronic Disclosure Services			Learn how to find hidden or hard-to-find data, recreate past computer-related conduct, or access data that you think is forever lost. Computer Forensics Services			Learn how Kroll Ontrack can help you present evidence throughout the legal process. Courtroom Services
Computer Forensics - Electronic Discovery - Courtroom Services - Digital Forensic - Electronic Evidence - Computer Investigations - Mobile Phone Forensics