Be careful with document metadata

Last week, we indicated that there are a number of risks involved with accepting a printed document at face value. What follows are some visual examples of those pitfalls.

The below document represent the properties of a specific word document: This particular set of properties are derived from a Windows 10 Operating system, with word 2016 installed. At face value, it appears that the document was created on 04/05/2010 at 11:38 AM. However, from this document alone, we cannot establish whether the document was created on the said time and date as there are a number of variables to consider.

Property

Value

Code page

1252

Title

Jan Alleman

Subject

Consulting Agreement

Author

JA

Keywords

JanA

Template

Normal

Last saved by

Alleman

Revision number

8

Creating application

Microsoft Office Word

Total editing time

1 hours 24 minutes 0 seconds

Last printed

1999/03/23 05:04:00 PM +0200

Create time

2010/05/04 11:38:00 AM +0200

Last saved time

2010/05/04 01:01:00 PM +0200

Number of pages

8

Number of words

1489

Number of characters

8488

Security

0

Microsoft Word Version

Word Document 8

Company

ABC

Depending on your operating system and word version, different programs will indicate either last saved as/ last modification date.

From the above, you could see that there is a lot of Metadata in a document.  To reach a conclusion from the word document alone, will be unwise.  The reason for this is, that a person can manipulate the date and time by setting the date and time back, or with the use of a third party application.

It is always recommended that an expert investigate the computer where the document was reportedly created.  If the computer is not available, one needs to look at other avenues such as:

  • Email messages where this document was sent as an attachment and/or
  • Backups that were created of the data (Backup Tapes)
  • Operating System (each new operating system brings amendments and upgrades)
  • Word version (the terminology in different word versions can differ)
  • Document Version (the document version can indicate whether a document is a new creation and assist in a comparative study)
  • Date and Time (these can be manipulated and could have been manipulated by previous users or editors of a document- take care to enquire from an expert before this is accepted)
  • Last Printed (indicates when last the document was printed and can be very useful when a timeline is at issue and for example where a later printed and signed document is presented in evidence)
  • Created date (as mentioned above- this is not always the first created date, but can be in relation to the device used and may also assist in ensuring a proper time-line analysis)
  • Do not be confused when the metadata is presented as a screen print and accept it as such. All the above questions must be asked first (and do not confuse properties of a document, with the properties of the device from which the document is derived)

Below is an example of a screenprint of the same document from the same device but one containing the device property terminology and dates and the other the document terminology and dates. Note the different dates, which could all impact on the veracity of the document and some uncomfortable cross examination if your witness is not prepared to explain the different property sources.

 Picture1 Picture2 

 

Contact your digital forensic expert to assist in analysing documents handed too you as evidence.

Contributed by:
Brandon Buckton and Ilse Grobler
CyanreCyanre, the Computer Forensic Lab (Pty)Ltd
Phone: 0126640066

FacebookTwitterLinkedInRSS Feed