Every file carries information you cannot see when you open it: when it was created, with which program, on which device, sometimes by whom and where. This is metadata, literally "data about data". In a forensic analysis it can confirm an account of events, contradict it or open new lines of inquiry. But it must be read carefully, because not all metadata is equally reliable.
Three levels of metadata
It helps to distinguish where the information is stored.
| Level | Where it is | Examples |
|---|---|---|
| File system | In the disk structure | Creation, modification, access dates |
| Internal | Inside the file itself | EXIF in photos, author in documents |
| External | In linked services and systems | Cloud version history, sharing logs |
A file copied to a USB stick keeps its internal metadata, but its file system dates may change. That is why comparing different levels is often the most interesting part of the analysis.
Photos and EXIF data
Cameras and smartphones embed a block of information called EXIF in images. It may contain:
- date and time of the shot, according to the device clock;
- make and model of the camera or phone;
- shooting settings, such as exposure and focal length;
- geographic coordinates, if location was enabled;
- the software used for any edits;
- a small thumbnail preview of the image.
That last item is sometimes valuable: if a photo was cropped or retouched with programs that do not update the thumbnail, the preview may show the original image.
Many social platforms and messaging apps strip most EXIF data on upload. A photo received in a chat therefore rarely keeps its original information. A useful analysis needs the original file, taken from the device that shot it.
Office documents and PDFs
Modern word-processing documents and spreadsheets are, technically, archives containing several files, some of which are dedicated to properties. They often include:
- author and last user who saved the file, taken from the name configured in the program;
- creation and last-save dates stored inside the document;
- number of revisions and total editing time;
- organisation name and template used;
- sometimes comments, tracked changes and hidden text.
PDFs have their own information dictionary and often an XMP metadata block, with the program that generated the file and the dates. A PDF edited after creation may contain several layered versions, and analysing its structure can sometimes show what changed.
File system dates: be careful
The creation, modification and access dates shown by Windows or macOS are the most misunderstood. A few examples:
- when a file is copied to another drive, the creation date often becomes the date of the copy, while the modification date stays the original. The result is a file "modified before it was created", which is not an anomaly but normal behaviour;
- on many systems, the last-access date is not always updated, for performance reasons;
- downloading a file from the internet or extracting it from an archive can set different dates depending on the program used.
Drawing conclusions from these dates without knowing how they behave is one of the most common mistakes in improvised assessments.
How reliable metadata is
Metadata can be changed. Some programs alter dates, author and coordinates in a few clicks. This does not make metadata useless, but it means it should be treated as clues to verify, not as absolute truth. It becomes strong when:
- it is internally consistent, for example the EXIF date and the file creation date on the phone;
- it is confirmed by external sources, such as a cloud service's history or a message sent at that moment;
- it shows no traces of editing programs.
Conversely, inconsistencies such as a camera model different from the one owned, photo-editing software in the metadata or dates incompatible with other events deserve closer examination.
A practical example
A document is presented as written on a certain date. Its internal metadata instead shows a later last modification and a template introduced in a newer version of the program. This is not necessarily forgery, because the file may simply have been reopened and saved, but the account of events needs to be clarified.
In short
- Metadata lives in the file system, inside the file and in external services.
- Photos contain EXIF data, which social networks and chats often strip.
- Office documents and PDFs record author, dates and creating program.
- File system dates change with copies and downloads in often counter-intuitive ways.
- Metadata is a set of clues to compare with each other and with external sources.