Microsoft Office Metadata - What Every Attorney Should Know About The Hidden Information In Their Client's Documents
Whether you are a computer forensics examiner or a litigation support professional you should be aware of the hidden information inside Microsoft Word documents. Metadata is hidden data which reveals when a document was created, saved, printed, last 10 authors/locations and several other characteristics.
In a legal matter electronic files are considered evidence. It would stand to reason that metadata in Microsoft Word files is important since it can explain the timeline of events and other details related to the evidence.
There are many file types which contain metadata, however, in this article we are going to primarily focus on Microsoft Word documents.
Many people think of emails when metadata is mentioned. It is important to note that the fields in an email (i.e. 'To', 'From', 'Subject' etc.) are actually database fields and not the same as the hidden information contained in other file types.
In addtion to Microsoft office Word metadata there is file system metadata. File system metadata is stored outside of the Microsoft Word.
File system metadata is stored in the File Allocation Table (FAT). When viewing files in Windows Explorer the dates, times, size of the file is the file system metadata.
File system metadata is relevant for a different reason. Spoliation often refers to the improper collection of electronic files when the file system metadata is altered during collection.
Since the job of the collection phase is to preserve potential evidence spoliation can be a serious issue. Pinpoint Labs created a program called SafeCopy to allow users to copy files without altering metadata.
The following list represents a collection of the hidden information in a Microsoft Word document:
MICROSOFT WORD METADATA FIELDS- File Name, Title, Author, Comments, App Name, Version Date, Created Date, Last Printed, Date Last Saved, Total Edit Time, Template, Shared, Subject, Category, Company, Keywords, Manager, Last Saved By, Word Count,Routing SlipTrack Changes, Fast Saves, Hidden text, Graphics Hyperlinks, Document Variables, Include Fields, Page Count, Paragraph Count, Line Count, Character Count, Chars, Byte Count, Presentation Format, Slide CountNote Count, Hidden Slides, Multimedia Clips, Last 10 Authors.
A program which can quickly display information related to file system and Microsoft Office metadata is available through Pinpoint Labs and is called MetaViewer. MetaViewer is a great tools for computer forensic examiners and legal professionals who need to quickly view metadata and hash values. You can download MetaViewer from the Pinpoint Labs website.
