Metadata describes the data behind the data. It can be hugely beneficial to legal professionals to paint a digital timeline of events.
When proving the credibility of digital evidence, metadata can be crucial. Knowing what it is and its uses in court can be the difference between winning or losing a case.
- How reliable is metadata?
- Can metadata be wrong?
- Can metadata be used as evidence?
- What can metadata be used for? How metadata is used in digital forensics and in court
How reliable is metadata?
In litigation, metadata is evidence that describes the characteristics, origins, usage and validity of electronic evidence. Metadata attaches to electronically stored information (ESI), making it useful for legal professionals to figure out the who, what, when and where of files.
Critical information revealed by metadata can consist of author identity, file date creation and previous access to the file. You can use this digital footprint to see who’s been responsible for the creation or modification of ESI. Therefore, metadata can be relied upon to prove the credibility of evidence, strengthening your case in the process.
Can metadata be misleading?
Metadata can be the difference between winning or losing a modern case. That’s why it’s vital to spot metadata anomalies. However, this can be highly complicated. Any inconsistency in metadata could lead to accusations of data tampering and would put your case in a challenging position.
Organisations can turn to automation to thoroughly examine their data quickly. In some enterprise environments, advanced tools can comb through the data and point teams towards what needs to be fixed. Automated tools highlight which metadata is not consistent across the databases. With consistent filing, discrepancies are less common and metadata retains its validity.
It’s the organisation's responsibility to maintain this. If a company is being sued or discovery has already begun, it’ll be too late for them to fix their metadata.
It’s important to note that metadata can be wrong – but not always in a malicious way. For example, if a colleague were to make a copy of a document, the metadata would show a created date of when the copy was made, and not that of the original document.
If documents like this were to be brought into eDiscovery, they would appear as duplicates, as most platforms don’t measure file system metadata when running de-duplication algorithms. They do tend to store information from any duplicate documents found, however. Of course, metadata can also be deliberately spoliated.