Guide
Metadata For Lawyers What It Can And Cannot Prove
17 pages · 21 min read
Metadata records specific technical events.
- Metadata and timestamps
§ Guide
Metadata For Lawyers What It Can And Cannot Prove
This guide answers what metadata can and cannot prove, helping practitioners read the data about the data without being misled by it.
Ref · E-D · 2026 · §LIBClass · ConfidentialJuris · England & WalesStatus · Active
Guide · 17 pages · 21 min read · Published 2026-08-30
Designed for UK legal practitioners navigating digital evidence, this reference addresses the challenge of interpreting data about data without being misled by technical anomalies. Prepared by the Computer Forensics Lab e-discovery team, the text examines how metadata fields record specific technical events across file system, application, communication and media families, including EXIF and XMP data. It contrasts innocent rewrites caused by file copies, migrations and system syncs with deliberate manipulation signatures such as backdating. Practitioners are guided through safe field reading requiring cross-source corroboration, source architecture spanning device artefacts, backups and document management platforms, and proper chain of custody from initial collection to load file generation. Covering CPR Part 35 expert reports, disclosure protocol drafting, targeted interrogatories for opponents and e-discovery providers, and practical red flags, the material demonstrates how to evaluate claims regarding document creation, authorship and photo location. Through real world worked examples, checklists and technical limitations, it equips solicitors and barristers to determine when metadata provides robust proof, when fields have been overwritten innocently, and when specialist laboratory examination is required.
Share
Read this guide on your phone, open the PDF reader with the full text, browse guides by topic or go back to the full PDF library.
§ Credit and source
Published by Computer Forensics Lab on 2026-08-30. Original material of the practice, free to read, cite and download. See every guide's author and source.
§ Read Metadata For Lawyers What It Can And Cannot Prove
Download the PDFPrefer a PDF that matches this page exactly? Download the current text as a PDF, generated from the current wording of the guide, including any later corrections.
Page 1
METADATA · A GUIDE FOR UK LAWYERS Metadata for Lawyers: What It Can and Cannot Prove Reading the Data About the Data Without Being Misled by It COMPUTER FORENSICS LAB
§ ABOUT THE AUTHOR PREPARED BY COMPUTER FORENSICS LAB E-DISCOVERY TEAM MANIPULATION EXAM IN AT I ON CPR PART 35 EXPERT REPORT S FULL CHAIN-OF-CUSTODY DOCUMENTATION
§ CONTENTS In this guide 01 Executive summary 02 The problem in plain English: the data about the data 03 The metadata families: file system, application, communication and media 04 What rewrites metadata innocently: copies, migrations and sync 05 Reading fields safely: corroboration before conclusion 06 Metadata as manipulation evidence: backdating and its signatures 07 Preserving and producing metadata: collection to load file 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist
§ 01 · ORIENTATION Executive summary THE HEADLINE POINT: EVERYMETADATAFIELDRECORDSASPECIFICTECHNICALEVENT: KNOWWHICHEVENT, CORROBORATEACROSSSOURCES, ANDPLEADEXACTLYTHAT
§ 02 · FIRST PRINCIPLES The problem in plain English: the data about the data
§ 03 · THEFAMILIES The metadata families: file system, application, communication and media
Page 2
§ 04 · THEINNOCENTREWRITES What rewrites metadata innocently: copies, migrations and sync
§ 05 · SAFEREADING Reading fields safely: corroboration before conclusion
§ 06 · THEMANIPULATIONSIGNATURES Metadata as manipulation evidence: backdating and its signatures
§ 07 · CUSTODY OF THE FIELDS Preserving and producing metadata: collection to load file
§ 08 · THEWIDERMAP Source architecture: where else the evidence lives QUESTION CLOUD FILE'S OWN COMMUNICATION COUNTERPART DEVICE BACKUPS / FIELDS RECORD COPIES ARTEFACTS ARCHIVES DMS / PLATFORMS
§ 09 · IN THE WILD Worked examples EXAMPLE1 · THEANOMALYTHATWASALAPTOPREFRESH EXAMPLE2 · THE2019AGREEMENTWRITTENBY2022SOFTWARE EXAMPLE3 · THEPHOTOTHATPLACEDTHEPHOTOGRAPHER
Page 3
§ 10 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations
§ 11 · INTERROGATORIES & DRAFTING AIDS Questions to ask · Suggested wording Ask your client Ask your opponent Ask your e Discovery / forensic provider SUGGESTED WORDING · ME TA DATA PA R AG RAPHFORTHEDISCLOSUREPROTOCOL
§ 12 · QUICK CONTROL Checklist and red flags · When to involve a digital forensic expert The metadata checklist Red flags When to involve a digital forensic expert
§ 13 · COMMON QUESTIONS Frequently asked questions Can metadata prove when a document was really created? The author field names our opponent. Is that proof they wrote it? A key document's dates look wrong. Manipulation? Does email in g or copying a document really destroy metadata? Our documents were produced as PDFs and the other side now questions their dates. Are we stuck? Is metadata admissible, and how much weight does it get?
§ 14 · REFERENCE Glossary EXIF XMP Sources and authoritative references DISCLAIMER
§ HOW A SPECIALIST LABORATORY CAN ASSIST Working with Computer Forensics Lab Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY
§ Related documents
Guide
MacOS Spotlight And Metadata Deep Dive
17 pages · 26 min read
Spotlight indexes Mac files with extensive metadata, including origin and dates.
- Apple and macOS forensics
- Metadata and timestamps
Guide
Android Photos Media And Metadata
18 pages · 26 min read
Android photographs record when, where, and on what they were taken, similar to an iPhone's.
- Mobile and messaging evidence
- Metadata and timestamps
Instruct the practice
Bring us in early.
Defensibility is built, not retrofitted.
Whether you are responding to a regulator, preparing for disclosure, or scoping an internal investigation, start the chain of custody with a short, confidential conversation.