What is metadata and why is it important to an investigation?
Metadata is basically data about data. Specifically, metadata describes how, when, and by whom a particular electronic file was created, modified, and where it was transmitted. These technical aspects of a file often yield information and insight relevant to an investigation or litigation as it conveys a detailed account of a document’s history and distribution. Additionally, metadata can often be used to reconstruct a timeline of events, produce additional investigative leads, and establish a user’s knowledge regarding the existence and content of files.
