This guide, 'Metadata for Lawyers: What It Can and Cannot Prove', is prepared by Computer Forensics Lab's e-discovery team for UK litigators, in-house counsel, and investigators.
Guide · 17 pages · 21 min read · Published 2026-08-30
This guide, 'Metadata for Lawyers: What It Can and Cannot Prove', is prepared by Computer Forensics Lab's e-discovery team for UK litigators, in-house counsel, and investigators. It addresses the problem of 'the data about the data' and its implications in legal contexts. The guide covers metadata families, innocent rewrites from copies, migrations, and sync, and how to read fields safely through corroboration. It also details metadata as manipulation evidence, including backdating signatures, and best practices for preserving and producing metadata from collection to load file. Common mistakes, technical limitations, and questions to ask clients, opponents, and e Discovery providers are included, alongside a checklist and red flags for when to involve a digital forensic expert.
Read this guide on your phone, browse guides by topic or go back to the full PDF library.
17 pages · 21 min read
This guide, 'Metadata for Lawyers: What It Can and Cannot Prove', is prepared by Computer Forensics Lab's e-discovery team for UK litigators, in-house counsel, and investigators.
Published by Computer Forensics Lab on 2026-08-30. Original material of the practice, free to read, cite and download. The authority behind this subject is EDRM, the Electronic Discovery Reference Model, which you should read alongside this guide. See every guide's author and source.
Prefer a PDF that matches this page exactly? Download the current text as a PDF, generated from the wording shown here, including any later corrections.
METADATA · A GUIDE FOR UK LAWYERS Metadata for Lawyers: What It Can and Cannot Prove Reading the Data About the Data Without Being Misled by It COMPUTER FORENSICS LAB
§ ABOUT THE AUTHOR PREPARED BY COMPUTER FORENSICS LAB E-DISCOVERY TEAM MANIPULATION EXAM IN AT I ON CPR PART 35 EXPERT REPORT S FULL CHAIN-OF-CUSTODY DOCUMENTATION
§ CONTENTS In this guide 01 Executive summary 02 The problem in plain English: the data about the data 03 The metadata families: file system, application, communication and media 04 What rewrites metadata innocently: copies, migrations and sync 05 Reading fields safely: corroboration before conclusion 06 Metadata as manipulation evidence: backdating and its signatures 07 Preserving and producing metadata: collection to load file 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist
§ 01 · ORIENTATION Executive summary THE HEADLINE POINT: EVERYMETADATAFIELDRECORDSASPECIFICTECHNICALEVENT: KNOWWHICHEVENT, CORROBORATEACROSSSOURCES, ANDPLEADEXACTLYTHAT
§ 02 · FIRST PRINCIPLES The problem in plain English: the data about the data
§ 03 · THEFAMILIES The metadata families: file system, application, communication and media
§ 04 · THEINNOCENTREWRITES What rewrites metadata innocently: copies, migrations and sync
§ 05 · SAFEREADING Reading fields safely: corroboration before conclusion
§ 06 · THEMANIPULATIONSIGNATURES Metadata as manipulation evidence: backdating and its signatures
§ 07 · CUSTODY OF THE FIELDS Preserving and producing metadata: collection to load file
§ 08 · THEWIDERMAP Source architecture: where else the evidence lives QUESTION CLOUD FILE'S OWN COMMUNICATION COUNTERPART DEVICE BACKUPS / FIELDS RECORD COPIES ARTEFACTS ARCHIVES DMS / PLATFORMS
§ 09 · IN THE WILD Worked examples EXAMPLE1 · THEANOMALYTHATWASALAPTOPREFRESH EXAMPLE2 · THE2019AGREEMENTWRITTENBY2022SOFTWARE EXAMPLE3 · THEPHOTOTHATPLACEDTHEPHOTOGRAPHER
§ 10 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations
§ 11 · INTERROGATORIES & DRAFTING AIDS Questions to ask · Suggested wording Ask your client Ask your opponent Ask your e Discovery / forensic provider SUGGESTED WORDING · ME TA DATA PA R AG RAPHFORTHEDISCLOSUREPROTOCOL
§ 12 · QUICK CONTROL Checklist and red flags · When to involve a digital forensic expert The metadata checklist Red flags When to involve a digital forensic expert
§ 13 · COMMON QUESTIONS Frequently asked questions Can metadata prove when a document was really created? The author field names our opponent. Is that proof they wrote it? A key document's dates look wrong. Manipulation? Does email in g or copying a document really destroy metadata? Our documents were produced as PDFs and the other side now questions their dates. Are we stuck? Is metadata admissible, and how much weight does it get?
§ 14 · REFERENCE Glossary EXIF XMP Sources and authoritative references DISCLAIMER
§ HOW A SPECIALIST LABORATORY CAN ASSIST Working with Computer Forensics Lab Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY
17 pages · 26 min read
17 pages · 25 min read
Whether you are responding to a regulator, preparing for disclosure, or scoping an internal investigation, start the chain of custody with a short, confidential conversation.
