Page 1

METADATA · A GUIDE FOR UK LAWYERS Metadata for Lawyers: What It Can and Cannot Prove Reading the Data About the Data Without Being Misled by It COMPUTER FORENSICS LAB

§ ABOUT THE AUTHOR PREPARED BY COMPUTER FORENSICS LAB E-DISCOVERY TEAM MANIPULATION EXAM IN AT I ON CPR PART 35 EXPERT REPORT S FULL CHAIN-OF-CUSTODY DOCUMENTATION

§ CONTENTS In this guide 01 Executive summary 02 The problem in plain English: the data about the data 03 The metadata families: file system, application, communication and media 04 What rewrites metadata innocently: copies, migrations and sync 05 Reading fields safely: corroboration before conclusion 06 Metadata as manipulation evidence: backdating and its signatures 07 Preserving and producing metadata: collection to load file 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist

§ 01 · ORIENTATION Executive summary THE HEADLINE POINT: EVERYMETADATAFIELDRECORDSASPECIFICTECHNICALEVENT: KNOWWHICHEVENT, CORROBORATEACROSSSOURCES, ANDPLEADEXACTLYTHAT

§ 02 · FIRST PRINCIPLES The problem in plain English: the data about the data

§ 03 · THEFAMILIES The metadata families: file system, application, communication and media