Forensic Implications of Metadata in Electronic Files

By Ruhnka, John; Bagby, John W. | The CPA Journal, June 2008 | Go to article overview

Forensic Implications of Metadata in Electronic Files


Ruhnka, John, Bagby, John W., The CPA Journal


In this digital age, most business activities are transacted and recorded using networked information systems. Business and accounting records are prepared, reviewed, audited, and preserved in electronic form, commonly called electronically stored information (ESI). It is estimated that 94% to 99% of all business records are created and maintained in electronic form (National Law Journal, July 17, 2006) and most are never transformed into hard copy. A unique characteristic of electronic records is that they include hidden metadata that comprise extensive information about the creation of a file, including "MAC dates" (the dates a file was modified, accessed, and created), the date last printed, and, if deleted, when it was deleted and by whom. Metadata can also reveal the location of a file on a computer or network, the computer on which it was created, the name of the person who last saved the document, the number of revisions made, and any document ID or properties added to the document E-mails contain metadata that indicates the sender's address book information, the date a message was sent, received, replied to, forwarded, to whom copies were sent, and the existence of attachments.

Metadata has been called "the electronic equivalent of DNA" and it can shed light on the origins, context, authenticity, and distribution of electronic evidence (Craig Ball, Beyond Data about Data: The Litigator's Guide to Metadata 2005). CPAs-especially those involved in forensic accounting and litigation support-should be aware of how metadata is generated by software, and the potential significance of metadata in electronic business records and communications.

Metadata Production, Location, and Access

Metadata can be broadly divided into two categories. Application metadata is automatically created by an application and is embedded in every file created or edited using that software. Operating systems that control individual computers, servers, and other devices create systems metadata, which assigns file allocation table fields (file name, creation, length, and use) to all files stored on the system so that the operating system can identify and locate that file. Systems metadata resides in the system registry of the computer system or server used to access and store that file.

Many CPAs use Microsoft Office programs, including Word, Excel, PowerPoint, and Outlook. All of these applications automatically produce dozens of fields (types) of application metadata for each file they create. Application and systems metadata fields are created and updated for Word, Excel, and PowerPoint files each time a file is created, opened, or used, as well as the optional information about changes or versions that a user may intentionally track in a file. Adobe Acrobat software creates detailed metadata path information that can provide forensic information on PDF files.

Significance of Metadata in Litigation

A 2007 survey of litigation activities of 253 U.S. corporations revealed that 83% of respondents had new lawsuits filed against them in 2006 (Fulbright & Jaworski, Fourth Annual Litigation Trends Survey Findings, October 2007). The most common subjects of these lawsuits were labor/employment, contract enforcement, and personal injury. Litigation was also significant at the smaller companies surveyed: 17% had at least one lawsuit claiming $20 million or more, and 98% of mid-sized companies repotted one or more lawsuits of $20 million or larger. After a lawsuit is filed, a pre-trial discovery phase occurs during which the litigants are required to identify and disclose (produce) all information in their possession that is requested by the opposition as potentially relevant to the subject of the litigation. Because most settlements in litigation occur before a trial is held, electronic records and e-mails disclosed and evaluated by the parties during the discovery phase can often determine the outcome.

Once a lawsuit is filed or a party has been served with a document preservation request, a "litigation hold" prevails that requires the parties to preserve all evidence under their control that is poten'tially relevant to the subject of the litigation. …

The rest of this article is only available to active members of Questia

Already a member? Log in now.

Notes for this article

Add a new note
If you are trying to select text to create highlights or citations, remember that you must now click or tap on the first word, and then click or tap on the last word.
One moment ...
Default project is now your active project.
Project items
Notes
Cite this article

Cited article

Style
Citations are available only to our active members.
Buy instant access to cite pages or passages in MLA 8, MLA 7, APA and Chicago citation styles.

(Einhorn, 1992, p. 25)

(Einhorn 25)

(Einhorn 25)

1. Lois J. Einhorn, Abraham Lincoln, the Orator: Penetrating the Lincoln Legend (Westport, CT: Greenwood Press, 1992), 25, http://www.questia.com/read/27419298.

Note: primary sources have slightly different requirements for citation. Please see these guidelines for more information.

Cited article

Forensic Implications of Metadata in Electronic Files
Settings

Settings

Typeface
Text size Smaller Larger Reset View mode
Search within

Search within this article

Look up

Look up a word

  • Dictionary
  • Thesaurus
Please submit a word or phrase above.
Print this page

Print this page

Why can't I print more than one page at a time?

Help
Full screen
Items saved from this article
  • Highlights & Notes
  • Citations
Some of your highlights are legacy items.

Highlights saved before July 30, 2012 will not be displayed on their respective source pages.

You can easily re-create the highlights by opening the book page or article, selecting the text, and clicking “Highlight.”

matching results for page

    Questia reader help

    How to highlight and cite specific passages

    1. Click or tap the first word you want to select.
    2. Click or tap the last word you want to select, and you’ll see everything in between get selected.
    3. You’ll then get a menu of options like creating a highlight or a citation from that passage of text.

    OK, got it!

    Cited passage

    Style
    Citations are available only to our active members.
    Buy instant access to cite pages or passages in MLA 8, MLA 7, APA and Chicago citation styles.

    "Portraying himself as an honest, ordinary person helped Lincoln identify with his audiences." (Einhorn, 1992, p. 25).

    "Portraying himself as an honest, ordinary person helped Lincoln identify with his audiences." (Einhorn 25)

    "Portraying himself as an honest, ordinary person helped Lincoln identify with his audiences." (Einhorn 25)

    "Portraying himself as an honest, ordinary person helped Lincoln identify with his audiences."1

    1. Lois J. Einhorn, Abraham Lincoln, the Orator: Penetrating the Lincoln Legend (Westport, CT: Greenwood Press, 1992), 25, http://www.questia.com/read/27419298.

    Cited passage

    Thanks for trying Questia!

    Please continue trying out our research tools, but please note, full functionality is available only to our active members.

    Your work will be lost once you leave this Web page.

    Buy instant access to save your work.

    Already a member? Log in now.

    Search by... Author
    Show... All Results Primary Sources Peer-reviewed

    Oops!

    An unknown error has occurred. Please click the button below to reload the page. If the problem persists, please try again in a little while.