How To Use Metadata As An Examination Tool


By Nicholas J. Deleault

In today’s computer dependant world, the zealous advocate must be able to navigate his way through every conceivable form of discovery in order to effectively represent his or her client.  Failure to seek the appropriate records or the failure to respond to discovery requests with the appropriate electronic discovery knowledge could potentially expose both client and attorney to the risk of sanctions for discovery abuses and/or result in the spoliation of evidence.  Knowledge of the electronic evidence is crucial to any attorney hoping to retain clients.  Once electronic evidence is in hand though, an attorney faces additional obstacles, specifically, regarding how to properly use such evidence.  Gaining a true understanding of metadata can mean the difference between success and failure.
Metadata is more than simple electronic evidence.

General electronic discovery typically considers easily accessible electronic files, such as those on an active network file server.  Metadata is more obscure and difficult to locate, and is found through an examination of often hidden and deleted files, or even left over file fragments that were supposed to be deleted.  Specifically, metadata describes how, when and by whom particular set of data is collected and formatted.  Metadata can often be thought of as the “DNA” of documents.

It is hidden from view and often contains the most damaging information.  Discovering the metadata behind a piece of data, such as a document or spreadsheet, can reveal the authors of the document, all comments and edits made and any other trait related to its creation.  Mining for metadata is the newest tool in the ongoing battle between those seeking to conceal and those seeking to reveal electronic evidence. The “hard” paper evidence obtained throughout the discovery process only reflects the most recent form of the document, and often does not reveal the most useful information.

Direct or cross examination based strictly on the hard copy document restricts the examiner to questions regarding the information only contained on the printed page.  It is therefore difficult to determine the document’s authenticity, its author and any edits made while the copy was still a work in progress.  Often times though, these documents were created in a word processing program such as Microsoft Word, which leaves a trail of information regarding the life of the document itself.  The use of a skilled attorney or a forensic examiner can lead to the discovery of every detail regarding the document.

The metadata contained in documents will include ‘tags’ and information regarding when and by whom the document was created, what changes were ever made to the document, and even what else may have been on the creator’s computer screen when making the document.  For example, a forensic examination of a single fax cover letter can reveal not only the name and fax number but can also reveal every message sent by that user, using the same fax template.  The metadata can reveal this information because when text is deleted using a word processor program, it is never truly removed from the document. In reality, when deleting the text the processor is simply instructed not to print or display the data.  Knowledge of what the creator thought was deleted can be an extremely useful tool, for persuasive, substantive and impeachment purposes throughout the trial.

The hiring of an expert Data Forensics Expert may well be a justified expense when in the best interests of a client.  The examiner will be able to help paint a picture by providing a story line with corroborating evidence including creation and edits dates, authorship, all communications regarding the document and potentially even the intent behind the acts.   Such experts should be used in cases where substantial hidden digital evidence may exist. This is not restricted to intellectual property cases, but may involve every area of law, including family law, breach of contract, discrimination and sexual harassment.

The ability to spot the cases when metadata may be recovered is an important skill for any practitioner.  The more important skill, however, is the ability to know how to use the electronic discovery means once identified.  It is wise to use an attorney experienced in electronic discovery and metadata mining when faced with such a case.  <c>”Because of their ubiquitous nature, documents stored in electronic form…should be specifically targeted by counsel in developing their discovery plans.  Failing to do so may not only prejudice their case, but may also constitute malpractice.”  CEB California Discovery Practice 3rd Ed Vol. 2, §8.24 p. 711 (1998).  It is the duty of every advocate to have a sufficient level of knowledge regarding electronic discovery and metadata, or to at least associate with counsel who does.  Failure to understand the importance and usefulness of metadata and electronic discovery in general may lead to undesirable consequences.

About the Author

This article was written by Nicholas J. Deleault, Pierce Law Center ’07. Nicholas writes select legal articles for the Law Firm’ Blog of Goldstien and Clegg, a Massachusetts Internet and cyberlaw firm.

Leave a Reply

You must be logged in to post a comment.