What You Need To Know About Microsoft Office Metadata

WHAT IS MICROSOT OFFICE METADATA? Metadata is often described as ‘data about data’. In other words it is ‘hidden’ information in Microsoft Office files that provides details related to the creation, modification and current state of the file.

It is easy to understand that during a computer forensic exam or the discovery phase of a litigation metadata can play an important role. Metadata can assist with an evidence timeline and identify those who touched the evidence.

All Microsoft Office documents contain metadata and there are dozens of other file types which also store valuable information about the file. These topics will be covered in a different article.

In a legal case many think of emails when referring to metadata. Often the fields (i.e. 'To', 'CC', 'From', 'Date Sent' etc.) are referred to as metadata. Actually, these are database fields as oppose to the hidden information in files.

WHAT IS FILE SYSTEM METADATA? - Before we discuss the internal metadata of Microsoft Office documents it is important to understand there is also file system metadata associated with Microsoft Office documents.

File system metadata is independent of the Microsoft Office metadata and is stored in the FAT (File Allocation Table) which is similar to a table of contents for the operating system (i.e. .Microsoft Windows).

Spoliation in a legal case often refers to files where the file system metadata has been altered during the copy process.

When computer files are copied from the custodian computer to another location during a document production file system metadata can be altered. Pinpoint Labs has created the software ‘SafeCopy’ so files can be copied between locations without altering metadata.

The following list represents a collection of the hidden information in a Microsoft Word document:

MICROSOFT WORD METADATA FIELDS- File Name, Title, Author, Comments, App Name, Version Date, Created Date, Last Printed, Date Last Saved, Total Edit Time, Template, Shared, Subject, Category, Company, Keywords, Manager, Last Saved By, Word Count,Routing SlipTrack Changes, Fast Saves, Hidden text, Graphics Hyperlinks, Document Variables, Include Fields, Page Count, Paragraph Count, Line Count, Character Count, Chars, Byte Count, Presentation Format, Slide CountNote Count, Hidden Slides, Multimedia Clips, Last 10 Authors.

MetaViewer from Pinpoint Labs is a program that allows users to easily view the file system metadata and Microsoft Office metadata. MetaViewer also calculates and displays hash values for MD5, SHA-1 (SHA1) and SHA-256 (SHA256). Computer forensic examiners and litigation support professionals have found MetaViewer and valuable tool. MetaViewer can be downloaded from the Pinpoint Labs website.

Article Source: http://www.articlemonk.com

About the author: Jon Rowe is the President of Pinpoint Labs and a Certified Computer Examiner. To learn more about Pinpoint Labs click herePinpoint Labs Website - Computer Forensics Software and Services
Feel free to grab a unique version of this article from the Unique Articles Submissions Service

Please Rate this Article

5 out of 54 out of 53 out of 52 out of 51 out of 5 

Not yet Rated