Page 1

AUTHORSHIPATTRIBUTION · A GUIDE FOR UK LAWYERS Proving Who Created or Edited a Document Authorship From Metadata, Version Ladders, Platform Logs and Endpoints COMPUTER FORENSICS LAB

§ ABOUT THE AUTHOR PREPARED BY COMPUTER FORENSICS LAB E-DISCOVERY TEAM 19 where authorship is the issue.

§ CONTENTS In this guide 01 Executive summary 02 The problem in plain English: documents remember their authors, imperfectly 03 Internal metadata: author fields, revision data and what they actually record 04 Platform evidence: version ladders, audit logs and co-authoring attribution 05 Endpoint and transmission evidence: where the document was open, and who sent it 06 Content evidence: linguistic, structural and stylistic attribution 07 The lattice and the traps: joining sources and address in g alternatives 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist

§ 01 · ORIENTATION Executive summary THE HEADLINE POINT: AUTHORSHIPISPROVEDBYJOININGFOURSTRATA: WHATTHE DOCUMENTSAYSABOUTITSELF, WHATTHEPLATFORMRECORDED, WHAT THE END POINT REMEMBERS, ANDWHATTHEWRITINGREVEALS: EACHFALLIBLEALONE, EACH CORROBORATINGTHEOTHERS, WITHTHETRAPSNAMEDBEFORETHEFINDINGISMADE

§ 02 · FIRST PRINCIPLES The problem in plain English: documents remember their authors, imperfectly

§ 03 · INTERNALMETADATA Internal metadata: author fields, revision data and what they actually record