If you work in eDiscovery, you probably know about metadata and the additional information it provides in discovery. As a recent article from Forensic Discovery illustrates, lack of metadata with produced evidence in discovery not only is less informative, it can call into question the authenticity of the evidence itself.
In the article Importance of Metadata in Digital Forensics and eDiscovery, the author defines metadata (i.e., data about data) and illustrates how much additional information it can provide. For example, Excel workbooks would be a lot less useful printed out or in image form as you wouldn’t be able to see the underlying formulas behind many of the numbers, Word documents printed out or imaged may not show tracked changes or comments (unless set to show them during print), PowerPoint slides printed or imaged wouldn’t show speaker notes, etc. You wouldn’t know when a document was created, last updated or last printed. And there’s so many more things you can learn from the metadata within ESI in discovery.
Metadata can also be used to authenticate evidence, or, conversely, the lack of metadata can make evidence subject to tampering. The article provides three examples of cases where forensic examination of the evidence was important: the first one involving printed text messages, the second one involving emails and the third one involving photographs. I won’t steal their thunder on the specifics, but they’re all interesting cases that illustrate the importance of metadata. You can check out their article here.
Rule 34(b)(1)(C) indicates that the requesting party in discovery “may specify the form or forms in which electronically stored information is to be produced.” If you’re a receiving party, why wouldn’t you request the ESI in its native form to get all the metadata you can? And, if you’re a producing party, you need to preserve the ESI in its native form – even if you’re producing images and load files – to ensure you can provide authentication in case the evidence comes into question. Evidence falsification doesn’t happen often, but it does happen, especially when there’s a lack of metadata. Metadata gets to the truth of the evidence.
So, what do you think? Have you ever been involved in a case where evidence was falsified due to a lack of metadata? Please share any comments you might have or if you’d like to know more about a particular topic.
Disclosure: Forensic Discovery is an Educational Partner and sponsor of eDiscovery Today
Disclaimer: The views represented herein are exclusively the views of the author, and do not necessarily represent the views held by my employer, my partners or my clients. eDiscovery Today is made available solely for educational purposes to provide general information about general eDiscovery principles and not to provide specific legal advice applicable to any particular circumstance. eDiscovery Today should not be used as a substitute for competent legal advice from a lawyer you have retained and who has agreed to represent you.
