Metadata is alluring when examining questioned digital documents: they seem to hold so much promise, but metadata is so easy to modify. This video explores the use of metadata in digital document analysis. It is found that - depending on the type of document - modification of metadata may have unintended consequences that may reveal the fact that the metadata (and/or the document itself) has been modified. This makes metadata more robust than expected.
It is argued that metadata establishes an expectation about the tool used to create and/or edit the document. This is a useful starting point to examine both the structure of the document (as discussed in previous episodes), as well as to examine the composition and format of the embedded metadata to verify that it is consistent with what is expected from the purported tool used to create and/or edit the document. The attempts the keep metadata backwards compatible has lead to redundancy, which enables one to examine internal consistency. External consistency provides further avenues for metadata examination.
The video is part of a lecture series produced at home to continue online education during COVID-19 lockdown.
