Subscriber Benefit
As a subscriber you can listen to articles at work, in the car, or while you work out. Subscribe Now
Metadata provides context to answer the who, what, where, when and sometimes the how of a file. Every file contains metadata, though a number of factors can deeply impact the quantity and depth.
Sometimes metadata is intentionally removed to protect exposure of sensitive details including names, comments, and revision history.
Other times, especially within the discovery process, the production of metadata is required. However, metadata can be messy, especially when files have been moved.
For instance, we may all scratch our heads to see a “last modified date” that precedes a “create date,” but if files are not handled with care this is not an uncommon occurrence.
Metadata overview
Whether collaborating on drafts or reviewing discovery documents, metadata tells us a story about the journey our files have traveled.
Often these include dates, people, file names, and locations. However, the monikers for “create date” or “file path” can sometimes be a bit misleading.
How metadata gets created
It would not be unreasonable to assume that “file path” indicates where the file lived during the normal course of business. However, files don’t use a change of address form when they move, the file path is automatically updated anytime the file relocates.
This field will always reflect the file location currently or upon collection. This means if discovery tools are not used and someone moves files in Outlook or Windows File Explorer to be produced into a new folder called “to produce” before exporting them, the metadata will reflect “to produce” rather than the original file path.
While it may seem obvious that “create date” indicates the date a file was created, it is a bit more nuanced than that.
This field is populated with the “date created” in a particular system. If a file created last year is opened from an external hard drive and saved to my computer’s “downloads” folder, the “create date” in the downloads folder will display today’s date.
Similarly, if a file created last week is dragged from my computer to the Dropbox tab of my internet browser, the “create date” in Dropbox will now reflect today’s date. These changes in value reflect the date that file was created in that particular system.
Even when the “create date” is adjusted, the date last modified often remains the same between the various locations. As a result, a file that was moved could have a “last modified date” that precedes the “create date.”
The behavior of this field can vary between systems as some platforms like Dropbox update the “last modified date” when the “date created” is modified.
Images provide another tricky situation as the “date created” field does not necessarily reflect the date a photo was taken.
Instead, “date created” represents the date it was first saved to the current system, which is often not the device that took the picture.
Therefore a picture taken in 2022 may show a “date created” of 11/20/2025 because of the date it was saved to the computer.
Unlike many other file types, images have the ability to store EXIF metadata which can store other valuable data including the date the photo was taken. This information can be viewed using an EXIF Viewer tool, but some platforms remove this additional metadata.
While this may seem unnecessary, it is similar to the scrubbing of metadata from any work product to protect sensitive data, which in this case could include the GPS coordinates of the photo location, software used to edit, make/model of camera, etc.
Preventing metadata changes
With these things in mind, why does some metadata remain intact, especially that which has been produced in litigation?
It is deeply rooted in the way in which the data is handled. The reason that discovery data is often kept intact is because the data is collected and preserved in such a manner that when ingested into a discovery tool, the metadata remains intact.
However, if alternative methods are used such as searching directly within Outlook or Windows Explorer, the metadata could be altered including the examples in the prior section.
If maintaining and preserving metadata is important, understanding the impact of everyday actions is crucial.
Relocating files: Using functions such as “move” or “copy/paste” to transfer files from one location to another within the same system will typically maintain the create date but will update file path to reflect new location.
When transferring local files to a cloud based program such as Dropbox or Box, using the “sync” function is the best solution for preservation of the create date field.
Images being transferred from a camera or phone can be synced to a cloud service, transferred to a computer via a hard wire or a memory card in order to keep such dates intact.
Actions considered ‘file creation’
Tools including “save,” “save as,” “upload,” “download,” unzipping files and dragging between systems such as computer and cloud are all actions that the system typically considers the creation of a new file and will result in a new “create date.”
Similarly, if a file is printed and later scanned from hard copy to electronic, all original metadata will be removed as a brand new file has been created.
Images that are texted, emailed or uploaded to social media will often strip the EXIF metadata. Taking a screenshot of a photo will strip all original metadata as a brand new file has been created.
The way you handle files today shapes the story those files tell going forward.
Handling data with care requires careful attention to detail in transferring data as well the utilization of appropriate tools for collection and storage specifically within the realm of litigation. Save the facts, not just the files. •
__________
Deanna Marquez ([email protected]) is a co-owner of the Indianapolis based legal technology company, Modern Information Solutions, LLC. Modern Information Solutions provides traditional IT services, software training, and litigation support specifically within the legal industry.
Please enable JavaScript to view this content.