Home | Computers | Data Recovery
Computer forensic examinations and litigation support projects often rely on Microsoft Office file metadata. Metadata is information stored in a file that identifies key attributes of the file and can assist a computer forensic examiner and lawyers by establishing key findings in a case. It can assist with the timeline of events for a suspect. The area of the file referred to as 'Last 10 Authors' is also called metadata, however, it isn't contained in the same area or accessible through the same applications as the other metadata fields. The last 10 authors/locations information can greatly assist computer forensic examinations and electronic discovery projects, however, it is important to know which software tools can access and scrub the last 10 authors information. Many don't realize that last 10 authors isn't normally displayed or made available when metadata is extracted or viewed through computer forensic software, electronic discovery extraction or metadata viewer utilities. The reason that last 10 authors remains hidden is that it doesn't fall into the OLE stream metadata category. What is OLE stream metadata? OLE stream metadata is what is commonly viewed through a metadata viewer or sometimes extracted during electronic discovery and contain fields such as Title, Author, Date Last Printed, Date Last Saved etc. Because the last 10 authors is stored in a different location and not easily accessible this information isn't normally extracted during the electronic discovery process. Many attorneys are concerned when they realize the information that is contained in their clients files in the last 10 author area. They become even more concerned when they realize their scrubbing software didn't eliminate the information in this area. In a recent computer examination I was examining a USB drive which contained the current working files of the suspect. We were also provided access to a laptop which the suspect claimed was the only computer used in addition to the office computer. Because of the age of the laptop, size of the hard drive and user log files we doubted that the suspect had used the laptop for much of anything for awhile. Additionally, there were two older operating systems intalled which haven't been used for many years. When we reviewed the last 10 authors information on dozens of current working files located on the USB drive we were able to determine that none of the files were created or recently modified on the laptop. In fact, we were able to determine the employee had access to two other systems which had been used to edit the working files. In addition to saving the location of the last 10 authors and locations when the user saves the file, it is also possible that the last 10 authors was updated during an autosave process. Microsoft Word will often autosave the contents of a file while the users is working on a document. Autosave will store this information in the background as the user works. To seasoned computer forensic examiners and attorneys the last 10 authors information is used to support their case or they may insure it is scrubbed before producing documents to opposing counsel. Not all electronic discovery vendors or computer forensic exaimers include last 10 author data in their processes. Pinpoint Labs has software and services geared towards analyzing and scrubbing last 10 authors data. In summary, last 10 authors is referred to as metadata, however, it isn't accessible through most computer forensic software or electronic discovery application. Last 10 authors data can be viewed and scrubbed using applications from Pinpoint Labs (Pinpoint MetaViewer, MetaDiscover). There are a couple other applications, however, the applications from Pinpoint Labs can access and scrub the data without altering the file system timestamps and is significantly quicker than other applications reviewed.
Article Source: http://www.rightarticle.com
Pinpoint Metaviewer and MetaDiscover are available from Pinpoint Labs websiteMetadata Tools - Last 10 Authors Feel free to grab a unique version of this article from the Unique Articles Submissions Service
Please Rate this Article
5 out of 54 out of 53 out of 52 out of 51 out of 5
Not yet Rated
Powered by Article Dashboard
