Laurence R. Penn, CFVT, Senior Forensic Animation/Video Specialist

Metadata, the mysterious “data about data.” But it doesn’t need to be so mysterious. And in forensics, metadata can be a helpful tool.

The metadata of a file is a list of information that describes the file’s data. Think of it as a file’s “About” page or “Bio” section, similar to what you would see in a social media account. Just like you might have your birthday listed in your bio, metadata can also contain the file’s birthday (better known as its creation date). And, like including your hometown or where you went to school, metadata can contain a file’s history, such as the software that created it or if (and when) the file was modified.

Most digital files contain metadata, which is usually brief, text-based information that describes the contents of the file with details like file name and file size. If the file is a video or an image, the metadata can also include dimensions. Metadata in videos and photographs can be very extensive and often includes GPS data and the camera settings from when the video or photograph was taken. In forensics, metadata can provide information to help determine the integrity and authenticity of a video or photograph.

However, the metadata of a file is not the end-all, be-all of it’s true identity. As easy as it can be to publish inaccuracies on social media, metadata can also lie. Details in metadata can be easily changed or manipulated. Handling of scene photographs can also alter, or even eliminate, the metadata. DJS Associates often receives scene photographs embedded in PDF files. Unfortunately, any metadata that may have been saved with the original photographs is typically discarded in the embedding process, which can be devastating to investigative efforts.

In a recent case, DJS Associates was provided with a video of an incident to assist with an accident reconstruction. Metadata analysis of the video file revealed information that listed the video editing software “Adobe Premiere Pro” as well as a file path with the software name and a username. Put together, this indicates that the video had likely been processed with video editing software, and it brings into question the integrity and authenticity of the video.

When it comes to most data, accuracy is a direct result of its integrity and authenticity. It is always important to interrogate and review a file’s metadata, if it even exists, to see what lurks within. You may find some interesting secrets…

Laurence R. Penn, CFVT, Senior Forensic Animation/Video Specialist with DJS Associates, Inc., can be reached via email at experts@forensicDJS.com or via phone at 215-659-2010.

Categories: Digital Forensics | Education | Laurence R. Penn, CFVT

Tags: Digital Evidence | Metadata | Photogrammetry | Software | Spoliation | Video Analysis