Search:

What You Need to Know about Microsoft Office Metadata

By: Jon Rowe Microsoft Word contains hidden information regarding a documents characteristics, when it was created, edited and which author modified the document. In addition to the visible text in a Microsoft Word document there is also information which isn't visible that track the document through creation and revision.

Since files are potential evidence and the timeline of events as well as what happen to the evidence is important it is easy to understand how metadata can help win or lose a case depending on whether or not the files belong to your client and what they contain.

All Microsoft Office documents contain metadata and there are dozens of other file types which also store valuable information about the file. These topics will be covered in a different article.

The information in emails commonly referred to as ‘metadata’ which includes ‘To:’, ‘From:’, ‘CC’ etc. are actually database fields and aren’t hidden. The purpose of this article is to deal with the hidden information contained in files related to Microsoft Office documents.

In addtion to Microsoft office Word metadata there is file system metadata. File system metadata is stored outside of the Microsoft Word.

The date, time, size and other information displayed in Microsoft Windows is referred to the file system metadata and is store in the File Allocation Table (FAT).

File system metadata is relevant for a different reason. Spoliation often refers to the improper collection of electronic files when the file system metadata is altered during collection.

When computer files are copied from the custodian computer to another location during a document production file system metadata can be altered. Pinpoint Labs has created the software ‘SafeCopy’ so files can be copied between locations without altering metadata.

The folowing paragraph contains a list of the common metadata fields contained in a Microsof Word document.

MICROSOFT WORD METADATA FIELDS- File Name, Title, Author, Comments, App Name, Version Date, Created Date, Last Printed, Date Last Saved, Total Edit Time, Template, Shared, Subject, Category, Company, Keywords, Manager, Last Saved By, Word Count,Routing SlipTrack Changes, Fast Saves, Hidden text, Graphics Hyperlinks, Document Variables, Include Fields, Page Count, Paragraph Count, Line Count, Character Count, Chars, Byte Count, Presentation Format, Slide CountNote Count, Hidden Slides, Multimedia Clips, Last 10 Authors.

MetaViewer from Pinpoint Labs is a program that allows users to easily view the file system metadata and Microsoft Office metadata. MetaViewer also calculates and displays hash values for MD5, SHA-1 (SHA1) and SHA-256 (SHA256). Computer forensic examiners and litigation support professionals have found MetaViewer and valuable tool. MetaViewer can be downloaded from the Pinpoint Labs website.