Document Metadata: Preservation and Evidence Limits

Read, Preserve and Explain Document Metadata

Document metadata includes properties stored within a document and information held by its file system or source repository. These layers can describe different events. A repository’s import time, for example, records receipt into that system rather than the document’s first creation.

Common fields include an author name, creation and modification values, application identifiers and custom properties. Embedded comments and tracked revisions can contain additional information about changes. Email headers record message-routing and addressing information, while attachments have their own properties. Preserve the message and attachment relationship when it matters.

Microsoft’s document-property guidance distinguishes editable standard properties from automatically maintained properties. An author field is therefore a starting point for an enquiry, not proof that the named person wrote the document.

Consider this fictional property set for a Word document called payment-instructions.docx. It is an illustrative record, not a tested forensic finding. Its visible text says, “Please pay the contractor using the account below.”

The author name does not identify who typed the payment instruction. The revision needs its surrounding content and source history before a reviewer can explain who changed the account number or why.

Distinguish File Properties From Proven Facts

A metadata observation becomes evidence of a person’s action only when the surrounding records support that connection. Establish which system wrote the field, what event it records and whether the account identifies an individual or a shared login.

Copying can create new file-system values. Exports can write a new document while carrying older embedded properties. Application settings and templates can carry a name from a previous user. Time-zone conversion can make two displays look different even when they describe the same instant. Editable fields can also be changed deliberately.

In the fictional example, “Morgan changed the bank details” is an unsupported attribution. “The received copy contains a tracked account-number replacement and an author field naming Morgan” describes the observations accurately.

To investigate further, compare the received attachment with the source repository’s version record and the original email. Check the sender’s account, access records and any witness explanation. Record the original timestamp text and its offset before converting it to a common time zone. A timestamp without an established zone leaves the sequence unresolved.

A mismatch calls for a specific check. If the export’s creation value is later than the underlying correspondence, compare it with the export event. If an author name conflicts with the sender, examine the template and account history. Neither observation alone establishes fabrication. For statement-specific concerns, use the separate checks for a fake bank statement.

Inspect a Copy Without Altering the Original

Inspect an authorised working copy while retaining the received source in controlled storage. Before opening a file, establish your authority to access it and use an approved environment for untrusted documents. Keep macros and active content disabled.

1. Identify the source. Record who supplied the file, its received filename, source location and the transfer method. Keep the original message or export package where available.
2. Preserve the received bytes. Restrict changes to the preserved file and create a separate working copy. Record a cryptographic hash, such as SHA-256, using the team’s approved utility.
3. Compare the copy’s hash with the preserved file’s hash. Matching values support byte-for-byte consistency at that checkpoint. They do not establish who created the file or whether its contents are true.
4. Inspect the copy without saving changes. In desktop Word for Windows, use File, Info, Check for Issues, then Inspect Document. Select the inspection categories and run Inspect. Leave removal controls untouched during evidence inspection.
5. Record the observations. Note the inspecting application and version, selected categories, displayed values and timestamp interpretation. Mark inaccessible fields as inaccessible instead of assuming they are absent.
6. Close the copy without saving and repeat the integrity check. If the copy’s hash changes unexpectedly, retain it separately, create another copy from the preserved source and investigate the change.

Microsoft’s inspection instructions distinguish platforms: Word for Mac has manual properties under File, Properties, but lacks Document Inspector. Word for the web cannot view or change these properties. Choose an authorised desktop environment when the required inspection is unavailable.

A fictional reviewer’s note could read: “Received file D0042 copied for inspection. SHA-256 values match before opening. Desktop Word inspection reports tracked changes. Author field reads Morgan Lee. Repository revision history was not supplied. Copy closed without saving and hash remains unchanged.”

If two viewers disagree, record both results and their methods. An ordinary viewing application displays the properties it supports. Authentication requiring recovery of deleted history or attribution to a device needs a suitably qualified digital-forensic examiner.

Preserve Metadata During Filing and Export

Preserve metadata through document management by checking the exported result against the retained source, not just the filing screen. Imports can add repository identifiers. Conversions can omit revisions or attachments, and email exports can separate a message from its attachment. Renaming changes the filename used to find the document even where embedded properties remain intact.

For Federal Court proceedings, the electronic-discovery checklist addresses original-format preservation and exchange protocols. It also addresses native information inaccessible in PDFs and keeping attachments with host documents. The Court approves the discovery plan and exchange protocol. Other courts and matter-specific orders can require different production arrangements.

Use the agreed requirements to test a handover before accepting it:

1. Define the required fields and relationships. Specify document identifiers, timestamp treatment, attachment links and whether native files or revisions must accompany rendered copies.
2. Export a representative sample. Include a document with tracked changes and an email with an attachment, alongside an ordinary file.
3. Compare each sample with its preserved source. Check visible content, required properties, version selection and attachment links. Confirm that renamed files map back to the original identifiers.
4. Investigate missing or conflicting values. Check export settings and the source’s available fields. Record a genuine absence separately from a field the export dropped.
5. Accept the handover after the required comparisons pass. Retain the source package and the mapping needed to retrieve each original.

A PDF that looks correct can still lack information required by the protocol. Where a required revision or attachment disappears, correct the export or supply the required native material before accepting it. The wider storage choices belong in the guide to document management software for lawyers.

For bank-statement analysis, FinTrace saves professionals hours of conversion and review while keeping findings connected to the source PDF filename and page. The searchable ledger and findings report put the underlying statement evidence within reach during the matter.

Review Disclosure Copies and Record Changes

Metadata removal is a legal production decision carried out on an authorised copy. Preserve the original and record the reason for each removal before scrubbing. Apply the court’s orders and the matter’s production protocol to hidden content as well as visible pages.

Metadata is not automatically privileged. A lawyer’s name in an author field does not establish the purpose or confidentiality of the underlying communication. Australian Government Solicitor’s privilege guidance explains the role of confidential communications and their dominant purpose under Australian privilege principles. The applicable law and circumstances determine the claim.

Have the responsible lawyer decide whether a comment or revision contains privileged advice, discoverable evidence or irrelevant personal information. Record any withholding or redaction as the protocol requires. Avoid blanket removal that destroys information the receiving party is entitled to receive.

Microsoft’s hidden-data guidance recommends working on a copy because removed information may be irrecoverable. Its inspector checks categories including comments, revisions and hidden text, but does not detect every way content can be concealed.

After authorised removal, reopen the disclosure copy and inspect it again. Check the visible document alongside the categories approved for removal, including comments and revisions. Confirm that required identifiers and attachments remain. Keep a change record linking the disclosure copy to its preserved source, with the approving lawyer and the removal method recorded.

Release the disclosure copy only when the authorised changes are complete and the required content remains accessible. If the export loses a required relationship or retains material approved for removal, hold that copy for correction while preserving the original. The broader preservation-to-production process is covered in electronic discovery.