Microsoft Word Metadata - Last 10 Authors Explained

Computer forensic examinations and litigation support projects often rely on Microsoft Office file metadata. Metadata is information stored in a file that identifies key attributes of the file and can assist a computer forensic examiner and lawyers by establishing key findings in a case. It can assist with the timeline of events for a suspect.

The area of the file referred to as 'Last 10 Authors' is also called metadata, however, it isn't contained in the same area or accessible through the same applications as the other metadata fields. The last 10 authors/locations information can greatly assist computer forensic examinations and electronic discovery projects, however, it is important to know which software tools can access and scrub the last 10 authors information.

Many computer examiners and attorneys have found out the hard way that last 10 authors isn't normally extracted or displayed when using several popular computer forensic or electronic discovery processing software.

The reason this information isn't available during normal metadata extraction processes (OLE stream) is that last 10 authors isn't stored in the same location as the other OLE metadata. Additionally, the tools provided by Microsoft to extract metadata (which many software developers use) doesn't include last 10 authors.

Once an attorney realizes what information can be available from last 10 authors and locations they can be elated or very concerned depending on who they are representing. It is of additional concern when attorneys realized their scrubbing software or vendor didn't remove this information.

We were recently hired to review a couple computer systems and a USB drvie of a corporate employee. We were told that the two computers provided were the only systems that were used by the employee.

We were a bit suspicious when we were told the laptop was used whenever the suspect wasn't in the office. Our suspicions were a result of determining the laptop was 5 years old and contained partitions that included DOS and Windows 3.1.

We were able to confirm our suspicions on this case using the last 10 author data from several Microsoft Word files on the USB drive that the suspect used to store their working files. We were also able to identify two other computers that the suspect was using to create and edit files which were never examined or produced in the case.

The last 10 authors provides not only the author but the location of the file. Additionally, the autosave feature in Word can cause the location of a file to be stored even if the user didn't manually save their documents.

There are numerous examples of how the last 10 authors is used to win and defend cases. The savy attorneys and computer forensic examiners review this information when examinig their clients files or those produced by opposing counsel.

Not all electronic discovery vendors or computer forensic exaimers include last 10 author data in their processes. Pinpoint Labs has software and services geared towards analyzing and scrubbing last 10 authors data.

In closing, metadata is valuable information that can help establish evidence timelines, file location and dozens of other facts related to a case. The last 10 authors metadata is extremely valuable but not easily accessible to common computer forensic and electronic discovery processes. Make sure you incorporate last 10 authors in your next project. Pinpoint Labs offers MetaViewer and MetaDiscover software tools as well as metadata consulting services.

Article Source: http://www.uberarticles.com/articles

About the author: Jon Rowe is the President of Pinpoint Labs and a Certified Computer Examiner. To learn more about Pinpoint Labs click herePinpoint Labs Website - Computer Forensics Software and Services Don't reprint the same version as everyone else. Get your own unique content Metadata tools article here.

This article is licensed under a Creative Commons Attribution-No Derivative Works 3.0 Unported License, which means you may freely reprint it, in its entiretly, provided you include the author's resource box along with LIVE links (without "nofollow" tags).

Please Rate this Article

Not yet Rated