Metadata Forensics

Metadata is “data about data.” Metadata can be attached or associated with various types of ESI including: Document Files, Photos, Text Messages, Email Messages, as well as physical items such as CDs and DVDs. Common metadata elements include Titles, Creator Information, File Dates, Types, File Size, Version History, etc.

In terms of dates, files stored in modern operating systems generally have the following dates associated with them:

Date Created:
The date & time that this file was created on this machine, this would include the date downloaded from the Internet.

Date Accessed:
This is the last date that the file was accessed for reading by the machine or user.

Modification Time aka MTIME:
A file's modification time represents when its contents were most recently changed. However, because operating systems don't check to see if the file actually changed, it can merely represent the last time the file was saved by the application that had the file open.

Digital Forensic Experts

Digital Forensics

Digital Forensics

Digital Evidence