Proving Who Created Or Edited A Document

AUTHORSHIPATTRIBUTION · AGUIDEFORUKLAWYERS Proving Who Created or Edited a Document Authorship From Metadata, Version Ladders, Platform Logs and Endpoints COMPUTERFORENSICSLAB § ABOUTTHEAUTHOR PRE PA REDBYCOMPUTERFORENSICSLABE - DISCOVERYTEAM 19 where authorship is the issue. § CONTENTS In this guide 01 Executive summary 02 The problem in plain English: documents remember their authors, imperfectly 03 Internal metadata: author fields, revision data and what they actually record 04 Platform evidence: version ladders, audit logs and co-authoring attribution 05 Endpoint and transmission evidence: where the document was open, and who sent it 06 Content evidence: linguistic, structural and stylistic attribution 07 The lattice and the traps: joining sources and addressing alternatives 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist § 0 1 · ORIENTATION Executive summary THEHEADLINEPOINT : AUTHORSHIPISPROVEDBYJOININGFOURSTRATA : WHATTHE DOCUMENTSAYSABOUTITSELF , WHATTHEPLATFORMRECORDED , WHATTHEENDPOINT REMEMBERS , ANDWHATTHEWRITINGREVEALS : EACHFALLIBLEALONE , EACH CORROBORATINGTHEOTHERS , WITHTHETRAPSNAMEDBEFORETHEFINDINGISMADE § 0 2 · FIRSTPRINCIPLES The problem in plain English: documents remember their authors, imperfectly § 0 3 · INTERNALMETADATA Internal metadata: author fields, revision data and what they actually record § 0 4 · PLATFORMEVIDENCE Platform evidence: version ladders, audit logs and co-authoring attribution § 0 5 · ENDPOINTANDTRANSMISSIONEVIDENCE Endpoint and transmission evidence: where the document was open, and who sent it § 0 6 · CONTENTEVIDENCE Content evidence: linguistic, structural and stylistic attribution § 0 7 · THELATTICEANDTHETRAPS The lattice and the traps: joining sources and addressing alternatives § 0 8 · THEWIDERMAP Source architecture: where else the evidence lives QUESTION LADDER + INTERNAL ENDPOINT TRANSMISSION CONTENT / COUNTERPART METADATA ARTEFACTS RECORDS ST YLE COPIES PLATFORM AUDIT LOG § 0 9 · INTHEWILD Worked examples EXAMPLE1 · THECLAUSETHATARRIVEDBETWEENDRAFTS EXAMPLE2 · THEANONYMOUSLETTERANDTHETEMPLATEITWASBORNFROM EXAMPLE3 · THEREPORTTHATCHANGEDAFTERTHECLIENTSAWIT § 1 0 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations § 1 1 · INTERROGATORIES & DRAFTINGAIDS Questions to ask · Suggested wording Ask your client Ask your opponent Ask your eDiscovery / forensic provider SUGGESTEDWORDING · INSTRUCTIONFORAUTHORSHIP AT TRIBUTION § 1 2 · QUICKCONTROL Checklist and red flags · When to involve a digital forensic expert The authorship checklist Red flags When to involve a digital forensic expert § 1 3 · COMMONQUESTIONS Frequently asked questions The document's author field names my client. Doesn't that settle it? Can we prove who inserted a specific clause? What about an anonymous document with all metadata stripped? Several people edited the document together. Who is the author? Is linguistic analysis admissible and reliable? The document was drafted with an AI tool. Who is the author? § 1 4 · REFERENCE Glossary Sources and authoritative references DISCLAIMER § HOWASPECIALISTLABORATORYCANASSIST Working with Computer Forensics Lab Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY