Metadata has been defined as data about data.  There are two types of metadata.

 

System metadata is data stored by the operating system about a specific file or document.  This includes, depending on the operating system, such items as;  creation data, last access data, last modified date, and last written date.  System metadata can be very confusing due to many factors.   Each operating system and versions store data differently.  The creation date is usually the data the file landed on the media, not necessarily the actual date the file was created.  The Center for Computer Forensics will explain, in plain English to our clients and the court, when needed, how the system metadata applies to a specific examination.

 

File metadata is information stored within a document such as Microsoft Word.  This data is embedded within the document and the content varies with the program used to create the document and which version of the program was used.  Often this data is not immediately viewable in the software application used to create/edit the document but often can be accessed via a “Properties” view. Examples include document author, company name and creation and revision dates.

 

- Return to FAQ -