Metadata: the hidden evidence

Let us not forget the important role metadata played in combination with the infamous bottle of Grange that caused the demise of former NSW Premier Mr Barry O’Farrell. A key piece of ICAC’s evidence was the phone call metadata proving that conversations between Mr Barry O’Farrell and Mr Nicholas Di Girolamo took place on specific dates. Although ICAC has no idea what the content of the calls were in their exchange of phone calls in early 2011, Mr O’Farrell’s inability to explain why they took place, and together with the later revealed handwritten thank you note, ended his political career in spectacular fashion. 

But now let’s take a step back to the origins of the word. Meta is a Greek prefix meaning ‘after’ or ‘beyond’ and data is the plural form of the Latin datum which meant ‘(thing) given’. The word data later evolved in the English language to mean “transmittable and storable computer information”. So combining the two, it would mean something like information beyond the information. Simple, right? Or would you prefer Australian Prime Minister Tony Abbott’s metaphor of “metadata is the material on the front of the envelope” and not the content itself? The truth is there is no one set definition of metadata, it could potentially mean different things depending on the context.

In a forensic investigation context, Metadata would frequently be referred as the information that sits behind a particular electronic document. For example, in a typical Word document this includes information about its file size, the document’s author, who last modified it and when. This kind of information is stored within the Word file itself. Furthermore, information such as file system and operating system logs often record events such as file deletion, file access, file copy or transmission.

This information is potentially very useful in the context of litigation. Consider a hypothetical intellectual property theft case. A senior management personnel decides to take a product’s blueprint to a competing company for his personal gain. 

Consider the following scenario: after some arguments with the CEO, John Smith, the chief design engineer decides to leave his current firm, Alpha Pty Ltd to join a competitor, Beta Pty Ltd. He also decides that the design of the new revolutionary widget for which he had been working months on end was solely his efforts and therefore, he will take it with him to Beta. He transfers File A to his personal USB, USB #001. John changes the file name to File B on his home Mac computer in an attempt to cover his tracks. Lastly, he copies File B on a Beta company computer and presents it as a new project. Alpha is currently seeking to press charges for misuse of confidential information. How can metadata help? As shown in the diagram below, there are multiple instances in which an electronic trail of evidence is created.

 Image

As seen in the above diagram, the metadata can provide useful evidence of which devices were involved in File A’s journey to Computer C, even if the filename has been copied, deleted or changed on multiple occasions. In forensic science, this principle is known as Locard’s exchange principle (“Every contact leaves a trace”). Applying this principle to this scenario, every time the file is accessed or modified, a record is potentially created in the file, the USB drive, or the computer, thereby leaving an electronic trail of evidence. Moreover, metadata is discoverable in Court and could potentially become incriminating evidence.

With the world increasingly being more connected through cyberspace and electronic devices, it is important for people to understand what metadata is and how it’s used, particularly in the area of investigations and litigation. Metadata can be a powerful tool to prove a series of chronological events and a better understanding of it will lead to more concrete and favourable outcomes.

Nigel Carson, partner of our Forensic Technology practice, deals with metadata in his everyday work. Recently, he has also presented to various firms to aid their understanding of metadata and its uses. If you are interested in this topic, please feel free to contact Nigel at [email protected] to arrange a time.

Sources and further readings:

http://www.smh.com.au/digital-life/digital-life-news/what-is-metadata-and-should-you-worry-if-yours-is-stored-by-law-20140806-100zae.html

http://www.theguardian.com/commentisfree/2014/aug/06/explainer-what-is-metadata-should-i-worry-about-mandatory-data-retention

http://www.smh.com.au/comment/metadata-emerging-as-a-major-tool-in-icac-investigations-of-liberal-mps-20140815-104lh8.html

http://media.smh.com.au/news/federal-politics/brandis-fumbles-metadata-explanation-5656928.html