Home | Reference & Education | Legal
Computer forensic examinations and litigation support projects often rely on Microsoft Office file metadata. Metadata is information stored in a file that identifies key attributes of the file and can assist a computer forensic examiner and lawyers by establishing key findings in a case. It can assist with the timeline of events for a suspect. The area of the file referred to as 'Last 10 Authors' is also called metadata, however, it isn't contained in the same area or accessible through the same applications as the other metadata fields. The last 10 authors/locations information can greatly assist computer forensic examinations and electronic discovery projects, however, it is important to know which software tools can access and scrub the last 10 authors information. A common assumption amongst litigation support professionals and attorneys is that last 10 authors will be extracted during an electronic discovery process. In fact, last 10 authors isn't included in the OLE stream metadata and is not extracted by common electronic discovery products or vendors. The reason this information isn't available during normal metadata extraction processes (OLE stream) is that last 10 authors isn't stored in the same location as the other OLE metadata. Additionally, the tools provided by Microsoft to extract metadata (which many software developers use) doesn't include last 10 authors. Many attorneys are concerned when they realize the information that is contained in their clients files in the last 10 author area. They become even more concerned when they realize their scrubbing software didn't eliminate the information in this area. In a recent computer examination I was examining a USB drive which contained the current working files of the suspect. We were also provided access to a laptop which the suspect claimed was the only computer used in addition to the office computer. Because of the age of the laptop, size of the hard drive and user log files we doubted that the suspect had used the laptop for much of anything for awhile. Additionally, there were two older operating systems intalled which haven't been used for many years. When we reviewed the last 10 authors information on dozens of current working files located on the USB drive we were able to determine that none of the files were created or recently modified on the laptop. In fact, we were able to determine the employee had access to two other systems which had been used to edit the working files. The last 10 authors provides not only the author but the location of the file. Additionally, the autosave feature in Word can cause the location of a file to be stored even if the user didn't manually save their documents. To seasoned computer forensic examiners and attorneys the last 10 authors information is used to support their case or they may insure it is scrubbed before producing documents to opposing counsel. It is important to remember that not all metadata scrubbing applications remove the last 10 authors information, nor do most electronic discovery applications extract this content. Programatically, last 10 authors can be difficult to access and even more difficult to overwrite or remove. In summary, last 10 authors is referred to as metadata, however, it isn't accessible through most computer forensic software or electronic discovery application. Last 10 authors data can be viewed and scrubbed using applications from Pinpoint Labs (Pinpoint MetaViewer, MetaDiscover). There are a couple other applications, however, the applications from Pinpoint Labs can access and scrub the data without altering the file system timestamps and is significantly quicker than other applications reviewed.
Article Source: http://www.articlewarehouse.net
Pinpoint Metaviewer and MetaDiscover are available from Pinpoint Labs websiteMetadata Tools - Last 10 Authors Get a unique version of this article from our Metadata tools article directory
Please Rate this Article
5 out of 54 out of 53 out of 52 out of 51 out of 5
Not yet Rated
