Home | Computer | Software
Microsoft Word contains hidden information regarding a documents characteristics, when it was created, edited and which author modified the document. In addition to the visible text in a Microsoft Word document there is also information which isn't visible that track the document through creation and revision. Since files are potential evidence and the timeline of events as well as what happen to the evidence is important it is easy to understand how metadata can help win or lose a case depending on whether or not the files belong to your client and what they contain. Several file types contain metadata; however, the topic of this paper is to understand how Microsoft Office metadata is relevant to a civil litigation. Now, you may ask what about email ‘metadata’? Many people think of emails when metadata is mentioned. It is important to note that the fields in an email (i.e. 'To', 'From', 'Subject' etc.) are actually database fields and not the same as the hidden information contained in other file types. WHAT IS FILE SYSTEM METADATA? - Before we discuss the internal metadata of Microsoft Office documents it is important to understand there is also file system metadata associated with Microsoft Office documents. The date, time, size and other information displayed in Microsoft Windows is referred to the file system metadata and is store in the File Allocation Table (FAT). File system metadata is relevant for a different reason. Spoliation often refers to the improper collection of electronic files when the file system metadata is altered during collection. Since the job of the collection phase is to preserve potential evidence spoliation can be a serious issue. Pinpoint Labs created a program called SafeCopy to allow users to copy files without altering metadata. What data is contained in Microsoft Word metadata fields? Here is a list of the commond metadata fields: MICROSOFT WORD METADATA FIELDS- File Name, Title, Author, Comments, App Name, Version Date, Created Date, Last Printed, Date Last Saved, Total Edit Time, Template, Shared, Subject, Category, Company, Keywords, Manager, Last Saved By, Word Count,Routing SlipTrack Changes, Fast Saves, Hidden text, Graphics Hyperlinks, Document Variables, Include Fields, Page Count, Paragraph Count, Line Count, Character Count, Chars, Byte Count, Presentation Format, Slide CountNote Count, Hidden Slides, Multimedia Clips, Last 10 Authors. A program which can quickly display information related to file system and Microsoft Office metadata is available through Pinpoint Labs and is called MetaViewer. MetaViewer is a great tools for computer forensic examiners and legal professionals who need to quickly view metadata and hash values. You can download MetaViewer from the Pinpoint Labs website.
Article Source: http://www.a1-articledirectory.com
About the author: Jon Rowe is the President of Pinpoint Labs and a Certified Computer Examiner. To learn more about Pinpoint Labs click herePinpoint Labs Website - Computer Forensics Software and Services You can get a unique content version of this article.
Please Rate this Article
5 out of 54 out of 53 out of 52 out of 51 out of 5
Not yet Rated
