Search:

Microsoft Word Metadata - Last 10 Authors Explained

By: Jon Rowe. Many computer forensic examiners and attorneys are aware that metadata is valuable to many corporate cases. Metadata is the information stored within Microsoft Office and other files that can tell when files were created, edited, printed, stored and dozens of other facts.

An area of a Microsoft Word file commonly referred to as metadata is 'Last 10 Authors'. Last 10 authors/locations and the data captured can be valuable in a computer forensic examination or electronic discovery project.

Many computer examiners and attorneys have found out the hard way that last 10 authors isn't normally extracted or displayed when using several popular computer forensic or electronic discovery processing software.

What is OLE stream metadata? OLE stream metadata is what is commonly viewed through a metadata viewer or sometimes extracted during electronic discovery and contain fields such as Title, Author, Date Last Printed, Date Last Saved etc. Because the last 10 authors is stored in a different location and not easily accessible this information isn't normally extracted during the electronic discovery process.

Many attorneys are concerned when they realize the information that is contained in their clients files in the last 10 author area. They become even more concerned when they realize their scrubbing software didn't eliminate the information in this area.

You may be asking yourself, what's the big deal? How does this affect me? In a recent computer forensic exam we were provided a laptop of the suspect and told that it was the computer they used outside of the office. It was claimed that no other computer was used for work related files.

We were a bit suspicious when we were told the laptop was used whenever the suspect wasn't in the office. Our suspicions were a result of determining the laptop was 5 years old and contained partitions that included DOS and Windows 3.1.

We were able to confirm our suspicions on this case using the last 10 author data from several Microsoft Word files on the USB drive that the suspect used to store their working files. We were also able to identify two other computers that the suspect was using to create and edit files which were never examined or produced in the case.

The last 10 authors provides not only the author but the location of the file. Additionally, the autosave feature in Word can cause the location of a file to be stored even if the user didn't manually save their documents.

There are dozens of examples like this where last 10 authors 'metadata' can be used to help with a conviction or judgement. Informaiton can work for or against an individual and their legal representation. When it is determined that metadata is priveledge information or for any reason should be excluded, don't forget about last 10 authors.

When selecting a vendor or software to scrub documents it is important to insure that the last 10 authors is removed during scrubbing. Not all vendors or software applications will identify and remove the last 10 authors data.

In summary, last 10 authors is referred to as metadata, however, it isn't accessible through most computer forensic software or electronic discovery application. Last 10 authors data can be viewed and scrubbed using applications from Pinpoint Labs (Pinpoint MetaViewer, MetaDiscover). There are a couple other applications, however, the applications from Pinpoint Labs can access and scrub the data without altering the file system timestamps and is significantly quicker than other applications reviewed.

Article Source: http://www.lifeweightloss.com

About the author: Jon Rowe is the President of Pinpoint Labs and a Certified Computer Examiner. To learn more about Pinpoint Labs click herePinpoint Labs Website - Computer Forensics Software and Services
Feel free to grab a unique version of this article from the Metadata tools Articles Submissions Service

Please Rate this Article

Not yet Rated