paralegal power break: what you need to know about metadata
TRANSCRIPT
PARALEGAL POWER BREAKWhat You Need to Know About Metadata
E-Discovery: An Introduction to Digital Evidence
2
TYPES OF DIGITAL EVIDENCE▪ Types of digital evidence includes:
▪ DVDs, audiotapes, phone SIM cards, memory sticks, and more
▪ Almost anything - even a refrigerator - can contain digital evidence
▪ Data: actual information being retrieved, such as a letter or document
▪ Metadata: information about the data▪ Metadata in a picture file can tell investigators the type of camera used, date of
photo, and GPS coordinates where the photo was taken
E-Discovery: An Introduction to Digital Evidence
3
Figure 1-2 Data and metadata
E-Discovery: An Introduction to Digital Evidence
4
TYPES OF DIGITAL EVIDENCE▪ To access a photo’s metadata:
▪ Open Windows Explorer
▪ Right-click the photo file and click Properties
▪ Click the Details tab
Figure 1-3 Photo metadata in the Properties dialog box
E-Discovery: An Introduction to Digital Evidence
5
TYPES OF DIGITAL EVIDENCE▪ Metadata is also available for documents
▪ An investigator can see how long the person had the document open, how many words and characters are in the document, and more
▪ Metadata has to be handled carefully
▪ Recent court cases have cited or fined companies for deleting metadata
▪ However, including metadata showing who worked on a particular file might violate other standards▪ Such as privacy regulations and copyright infringement
E-Discovery: An Introduction to Digital Evidence
6
OVERVIEW OF METADATA IN E-DISCOVERY▪ Metadata Encoding and Transmission Standard (METS) - the standard
used for objects in a digital library▪ Developed by the Digital Library Association and maintained by the Library of
Congress
▪ METS profiles are found in:▪ PDF files
▪ Photographs
▪ CDs
▪ Other digital records
E-Discovery: An Introduction to Digital Evidence
7
OVERVIEW OF METADATA IN E-DISCOVERY▪ METS has five categories for metadata:▪ Descriptive metadata - lists metadata embedded in the document or
external descriptive metadata stored on an Internet server▪ Administrative metadata - describes how a document was created and
stored, the original source object, and intellectual property rights▪ File groups - groups electronic versions of a file, such as TIF versions,
PDF versions, etc▪ Structural map - shows users how to navigate all files▪ Behavior - deals with any executable portions of documents
E-Discovery: An Introduction to Digital Evidence
8
OVERVIEW OF METADATA IN E-DISCOVERY▪ OS metadata is what is stored by computer and network operating
systems▪ A typical OS keeps track of a file’s MAC times
▪ Show when the data was modified, accessed, and created
▪ Both an OS and NOS can show investigators the last time a file was accessed and whose login was used to modify a file
▪ In civil cases▪ Only the metadata embedded in documents is captured (not the OS or NOS
metadata)
E-Discovery: An Introduction to Digital Evidence
9
OVERVIEW OF METADATA IN E-DISCOVERY▪ Metadata is used mainly for organizing the discovery process
▪ Content of documents and e-mails is more important than the metadata
▪ Deleted information might be deemed “not readily accessible” or too costly to retrieve▪ It is most likely not produced
▪ What’s used in e-discovery is metadata embedded in documents▪ Which stores information such as author and application used to create it
CONTACT [email protected]
To learn more about eDiscovery purchase the text eDiscovery: An Introduction to Digital Evidence from Cengage Learning