CSO

I think of it as watching too much Law & Order (my favorite show!) The excitement of finding out that the contract document was actually created later then it should have been based on a date associated with a file. The author name, dates and all sorts of items are embedded in data. On its face, it can appear to solve a case but it can have its issues. Many times I have been asked to show a way to rely on metadata to prove one fact or another. While metadata, commonly referred to as data about data, can reveal information that is helpful it also can be very unreliable.
 
For example, files associated with dates assigned by Microsoft can contain have issues with what seems to be clear cut information. Microsoft can generate the creation dates in slightly different ways depending on how and where the file is saved. When a user opens a blank Microsoft Excel document and saves it on January 1, 2001, the created date would be January 1, 2001. However, if the user takes that same file and saves it to a new file path, a new date will be assigned - the date it was saved to the new path. Print date is a date that the application assigns every time a document is printed by a user. However, after every print operation the user must save the file to have the date updated. What if this is just one version of a document? Perhaps the original no longer exists or is stored elsewhere? On top of this all this information can be easy to alter.
 
In general, metadata is a valuable source of information but to jump to the conclusion the smoking gun has been found based on metadata may not be a wise choice. That being said, it can provide a strong clue about what happened and add into the facts to support a matter. Going back to Law & Order mode – consider it a great clue and go from there.