Guide
Proving Who Created Or Edited A Document
17 pages · 23 min read
This guide, 'Proving Who Created Or Edited A Document', is for UK lawyers, in-house counsel, and investigators.
- Metadata and timestamps
§ Guide
Proving Who Created Or Edited A Document
This guide, 'Proving Who Created Or Edited A Document', is for UK lawyers, in-house counsel, and investigators.
Ref · E-D · 2026 · §LIBClass · ConfidentialJuris · England & WalesStatus · Active
Guide · 17 pages · 23 min read · Published 2026-08-31
This guide, 'Proving Who Created Or Edited A Document', is for UK lawyers, in-house counsel, and investigators. It addresses how authorship is proved by joining four strata: what the document says about itself, what the platform recorded, what the end point remembers, and what the writing reveals. Each stratum is fallible alone, but corroborates the others. The guide covers internal metadata, platform evidence like version ladders and audit logs, end point and transmission evidence, and content evidence including linguistic, structural, and stylistic attribution. It details common mistakes, technical limitations, and provides questions to ask, a checklist, and red flags for when to involve a digital forensic expert. It also includes worked examples and frequently asked questions.
Share
Read this guide on your phone, browse guides by topic or go back to the full PDF library.
§ Credit and source
Published by Computer Forensics Lab on 2026-08-31. Original material of the practice, free to read, cite and download. See every guide's author and source.
§ Full text of Proving Who Created Or Edited A Document
Download the PDFPrefer a PDF that matches this page exactly? Download the current text as a PDF, generated from the wording shown here, including any later corrections.
Page 1
AUTHORSHIPATTRIBUTION · A GUIDE FOR UK LAWYERS Proving Who Created or Edited a Document Authorship From Metadata, Version Ladders, Platform Logs and Endpoints COMPUTER FORENSICS LAB
§ ABOUT THE AUTHOR PREPARED BY COMPUTER FORENSICS LAB E-DISCOVERY TEAM 19 where authorship is the issue.
§ CONTENTS In this guide 01 Executive summary 02 The problem in plain English: documents remember their authors, imperfectly 03 Internal metadata: author fields, revision data and what they actually record 04 Platform evidence: version ladders, audit logs and co-authoring attribution 05 Endpoint and transmission evidence: where the document was open, and who sent it 06 Content evidence: linguistic, structural and stylistic attribution 07 The lattice and the traps: joining sources and address in g alternatives 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist
§ 01 · ORIENTATION Executive summary THE HEADLINE POINT: AUTHORSHIPISPROVEDBYJOININGFOURSTRATA: WHATTHE DOCUMENTSAYSABOUTITSELF, WHATTHEPLATFORMRECORDED, WHAT THE END POINT REMEMBERS, ANDWHATTHEWRITINGREVEALS: EACHFALLIBLEALONE, EACH CORROBORATINGTHEOTHERS, WITHTHETRAPSNAMEDBEFORETHEFINDINGISMADE
§ 02 · FIRST PRINCIPLES The problem in plain English: documents remember their authors, imperfectly
§ 03 · INTERNALMETADATA Internal metadata: author fields, revision data and what they actually record
Page 2
§ 04 · PLATFORM EVIDENCE Platform evidence: version ladders, audit logs and co-authoring attribution
§ 05 · ENDPOINTANDTRANSMISSIONEVIDENCE Endpoint and transmission evidence: where the document was open, and who sent it
§ 06 · CONTENTEVIDENCE Content evidence: linguistic, structural and stylistic attribution
§ 07 · THELATTICEANDTHETRAPS The lattice and the traps: joining sources and address in g alternatives
§ 08 · THEWIDERMAP Source architecture: where else the evidence lives QUESTION LADDER + INTERNAL END POINT TRANSMISSION CONTENT / COUNTERPART METADATA ARTEFACTS RECORDS ST YLE COPIES PLATFORM AUDIT LOG
§ 09 · IN THE WILD Worked examples EXAMPLE1 · THECLAUSETHATARRIVEDBETWEENDRAFTS EXAMPLE2 · THEANONYMOUSLETTERANDTHETEMPLATEITWASBORNFROM EXAMPLE3 · THEREPORTTHATCHANGEDAFTERTHECLIENTSAWIT
Page 3
§ 10 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations
§ 11 · INTERROGATORIES & DRAFTING AIDS Questions to ask · Suggested wording Ask your client Ask your opponent Ask your e Discovery / forensic provider SUGGESTED WORDING · INSTRUCTIONFORAUTHORSHIP AT TRIBUTION
§ 12 · QUICK CONTROL Checklist and red flags · When to involve a digital forensic expert The authorship checklist Red flags When to involve a digital forensic expert
§ 13 · COMMON QUESTIONS Frequently asked questions The document's author field names my client. Doesn't that settle it? Can we prove who inserted a specific clause? What about an anonymous document with all metadata stripped? Several people edited the document together. Who is the author? Is linguistic analysis admissible and reliable? The document was drafted with an AI tool. Who is the author?
§ 14 · REFERENCE Glossary Sources and authoritative references DISCLAIMER
§ HOW A SPECIALIST LABORATORY CAN ASSIST Working with Computer Forensics Lab Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY
§ Common questions
Frequently asked questions
- The document's author field names my client. Doesn't that settle it?
- No: the field records the application's registered user on the machine where the document (or its template, or the document it was copied from) was created, and it is editable (§3): Example 1's field named a template; Example 3's date was reset by a copy. It is evidence of environment, corroborated by the platform ladder and the end point before it becomes evidence of a person.
- Can we prove who inserted a specific clause?
- Frequently: the version ladder's diffs localise the change to a rung, the rung names the saving account and time, and the end point and transmission records corroborate the session (§4-§5): Example 1's 19:52 check-in. Co- author in g adds caveats about session granularity, and the account-to-person step needs its own corroboration, stated as such.
- What about an anonymous document with all metadata stripped?
- The stripping is rarely complete: PDF XMP data often preserves source fields, end point s hold a u to recovery drafts and recent-file entries, the template and application build narrow the population, and stylistic comparison adds weight (§3, §5-§6): Example 2's letter was attributed through all four. The counterpart's copy may also carry what the author cleaned from theirs (§8).
- Several people edited the document together. Who is the author?
- Each contributor of each change, at the granularity the platform retained: per-save attribution always, per- paragraph where the application kept it (§4): the report attributes the material changes to accounts and sessions and states where the granularity runs out. "Author" becomes a schedule, not a name: which is usually the truthful answer for collaborative documents.
- Is linguistic analysis admissible and reliable?
- Forensic linguistics is an established discipline with its own methodology and limits, instructed as a separate specialism (guide 100 §3) and weighed by courts on its stated method and the material available (§6): it corroborates the technical strata far more often than it stands alone, and short questioned texts limit it. The report should say which role it plays.
- The document was drafted with an AI tool. Who is the author?
- The question shifts to who prompted, who edited and who adopted the output: the prompting account and session, the platform ladder of subsequent edits, and the person who circulated it as their own (§6, guide 126): the technical strata still attribute the human acts around the generated text, and the legal question of responsibility follows those acts. cflab. u k · e-disc ove r y. u k ©2026 Computer Forensics Lab Ltd ·cflab.uk ·e-discovery.uk ·info@cflab.uk ·+44 (0)20 7164 6915 Page 15 of 17
§ Related documents
Guide
MacOS Spotlight And Metadata Deep Dive
17 pages · 26 min read
- Apple and macOS forensics
- Metadata and timestamps
Guide
IOS Photos Media And Location Metadata
17 pages · 25 min read
- Metadata and timestamps
Instruct the practice
Bring us in early.
Defensibility is built, not retrofitted.
Whether you are responding to a regulator, preparing for disclosure, or scoping an internal investigation, start the chain of custody with a short, confidential conversation.