What metadata can tell you
File system and document metadata can indicate when a file was created, last modified and last accessed, who the recorded author is, and whether properties were changed. Communication metadata can show who spoke to whom and when. Together, these signals help build a reliable timeline.
Metadata can also reveal inconsistencies — for example, a document dated before the events it describes, or a timestamp that does not fit the rest of the record. Those inconsistencies are often where investigations turn.
How metadata supports review strategy
Metadata makes it possible to filter and organise large data sets: by date range, by custodian, by file type. That is what makes high-volume review proportionate. It also supports deduplication and document-family handling so reviewers are not shown the same material repeatedly or out of context.
Used well, metadata reduces the volume that has to be read while increasing confidence that nothing important is missed.
Handling metadata defensibly
Metadata is fragile. Opening a file, copying it carelessly, or exporting it through the wrong tool can change timestamps. That is one reason defensible collection matters: it preserves metadata before it can be disturbed. Throughout processing, the goal is to keep metadata accurate and to record any necessary transformations.
Key takeaways
- Metadata records who, when and what happened to a document.
- It enables date, custodian and type filtering that makes large review proportionate.
- Metadata inconsistencies are often where investigations find answers.
- Metadata is fragile — careless handling can alter it, which is why collection method matters.
Frequently asked questions
Can metadata be trusted?
Metadata is reliable when it is collected and preserved properly. If data has been handled carelessly, timestamps can be altered — which is why defensible collection is important.
Is metadata disclosable?
Metadata can be relevant and disclosable. How it is handled should be considered as part of the disclosure exercise.
What is document-family handling?
Keeping related items together — for example an email and its attachments — so they are reviewed in context rather than in isolation.
Discuss your matter in confidence
Speak to an eDiscovery specialist about forensic collection, processing and review support for your case.
Request a Confidential Consultation