Sie sind auf Seite 1von 12

Document Metadata and Computer Forensics

James Madison University Infosec Techreport Department of Computer Science

JMU-INFOSEC-TR-2006-003

Jeffrey R. Jones

August 2006

D oc ume nt Me tada ta and Com pu te r F or ens i c s

Sp rin g 200 6 Te rm Pap er fo r CS6 33 (Compu t er Fo ren si c s )

J e ff r ey R. J o ne s

INF O SEC Mas ter ’s Pro gra m

J ame s Madiso n Un iv ers it y

j on es j r @j mu . ed

u

ABS TRA C T

Me ta d at a c o n ta in e d w it h in d o c u me n ts se r v e s a v a lid p u r p o se in ma n y c ir c u msta nc e s, s u ch a s f a cil ita tin g th e co l lab o r a ti o n am o n g a g r o u p o f p e o p le . H o w e v e r, ma n y a re n o t a wa r e o f th e ty p e o f i n f o r ma tio n sto r e d w ith th e ir d o c u m e n ts , sp r ea d sh e e ts, a n d p r e sen t a tio n s. D u e d il ig e n ce is r e q u ir e d b y re sp o n s ib l e u se r s to e n su r e th a t se n sitiv e i n f o r mat io n is n o t le ak e d t o t h ir d - p a r tie s. U n til t h en , f o re n si c in v e st ig a to r s c o u ld ha v e ac c ess to a p le th o r a o f h id d e n d o c u me n t in f o r ma t io n . T h i s p a p e r e x am in e s h o w meta d ata is u se d in PDF d o c u me n ts an d d o c u me n t s, sp r ea d sh e e ts, an d p r e se n t at io n s c r ea te d in Mic r o so f t O ff ic e a n d O p e n O ff ic e . o rg . Se v e ra l in sta n c e s a r e e x a mi n e d w h e re me ta d a ta h a s le d to th e d isc o v e r y o f h id d e n i n f o r ma tio n . Th i s p a p e r a lso sh o ws h o w me ta d a ta i s s to r e d in d o c u me n t s, s p r ea d sh e e ts, a n d p r e se n t at io n s cr ea t ed in th e a f o r eme n ti o n e d a p p li ca tio n s. Fin a lly, t h is p a p e r w ill te st a n d d isc u ss th e f u n c t io n a lity o f sev e r a l to o l s a v a ila b le t o u se r s a n d in v e st ig a to r s th a t te st f o r th e p r e se n ce o f me ta d a ta .

1 . I NTRO DU CTI ON

Me ta d at a is a str u c tu r e d d e sc r i p ti o n o f o b je c t s, w h ic h c o n ta i n s c e r ta in p r o p e r tie s u se f u l t o the u se r a s we ll a s th e p r o g r a m o n w h ic h th e d o c u me n t wa s cr e a te d . Mo r e su cc i n ct ly, meta d a ta is d a ta th a t d e sc rib e s o t h er d a ta . I t is u se d in o ff ic e a p p l ic a ti o n s to sto r e v a ri o u s ty p e s o f da ta ra n g i n g f r o m th e a u t h o r 's n a me to th e la st time th e f ile wa s p r in te d . Me ta d a ta , f r o m its d e f i n itio n , ma y se em sa fe t o sto r e w ith in th e d o cu m e n t; h o w e v e r, it c a n b e a n in c r imi n a ti n g p ie ce o f e vi d e n ce ag a i n st t h e d o c u me n t' s a u t h o r, o wn e r, re v i e w er, p u b l is h e r, an d ma y p r o v i d e in f o r m a ti o n r e ga r d i n g th e n e t wo r k s to r a g e lo c a ti o n a s we ll a s th e u n iq u e id e n tif i e r o f th e ma c h in e o n w h ic h th e d o c u me n t , sp r e a d sh e e t o r p r e se n t at io n wa s c re a te d .

Me ta d at a c an r e ve a l se n si tiv e in f o r m at io n n o t d e em e d f o r p u b l ic u se , w h ic h c a n b e da ma g in g to a c o m pa n y o r in d iv i d u a l , b u t a t th e sa me t ime p r o v i d e a w ea l th o f u se f u l in f o r ma t io n f o r a f o r e n sic in v e sti g at o r. Fo r in sta n c e , an in v e stig a to r in v e stig a tin g a c ase o f in a p p r o p r i a t e mate r ia l ma y b e a b l e to tr ac k d o w n th e o r ig i n al o w n e r o f th e f il e b y s imp l y v ie w in g i ts me ta da t a.

Fo r e n sic a n a ly sis o f c o m p u te r s a n d th e d a t a co n t a i n e d th e re in ca n so me times b e a n e x tr e me ly d i ff i c u lt a n d tim e - c o n su min g ta sk . T h e c o mp le x itie s in v o l v e d in i n v e stig a ti n g c om p u te r cr i me s c a n so me times c a u se a n in v e stig a to r o r te a m o f in v e stig a to r s to o v e r lo o k sm a ll d e ta il s th a t c o u ld a t le a st le a d th e e xa min e r d o w n th e r ig h t p at h , if n o t an s we r q u e stio n s in a n d o f th e mse lv e s.

T h e a ma te u r a n d p r o f e ssio n a l f o r e n sic a na ly sis o f d o c u m e n t me ta d a ta h a s b ee n mo r e wi d el y p u b lic i ze d in p re v io u s y e a r s th a n a t a n y ti me in th e sh o r t h isto r y o f th e c o mp u te r re v o l u ti o n ; sp e ci fi c ex a mp le s o f wh i ch a re p r o v i d e d in a lat er

sect io n . I n a d d it io n , i ts u se a s p a r t o f th e f o r en s ic p r o c es s is in c lu d e d i n ma n y c o mp u te r f o r e n sic e d u c a tio n a l p r o g r a ms th r o u g h o u t t h e n a t io n . A n a ly z in g d o c u m e n t me ta d a ta is ev e n b r ie f ly d isc u sse d i n t h e 2 0 0 4 e d i tio n o f t h e Fo re n sic Ex a mi n a ti o n o f D ig ita l E v id e n c e: A G u id e fo r La w E n fo rc e m en t [ 1 ] .

T h e f o r e n sic an a ly sis o f meta d a ta is a lso b ei n g u se d mo r e e x te n siv e ly in le g a l ca se s. Fo r i n st a n ce , in J ac kso n v. Mic ro s o ft Co rp . , t h e d ef e n se wa s a b le to sh o w th a t th e e x - em p lo y e e c o p ie d , sto r e d , a n d d u p l ic a te d p r o p r ie ta r y in f o r ma t io n b a se d in so m e p a r t o ff o f th e d a te a n d time sta m p s sto r ed in th e f ile 's meta d a ta . T h is i n f o r ma t io n wa s p r e se n t e d to th e c o u r t , w h ic h s u b se q u en t ly d ismisse d th e su it a ga in st Mic r o so f t, be ca u se o f th e d i sc o v er y th a t th e p la in t iff mi sr e p r ese n te d h is a c tio n s [ 2 ] .

T h e c o u r t sy s te m a s a w h o le r e c o g n iz e s th e u se f u ln e ss o f me ta d a ta a n d i ts v ia b ility a n d a dmissib ili ty a s ev i d e n c e . Fo r

in sta n c e , in 2 0 0 5 , a ju d g e r u l e d th a t “ w h e n a p a r ty is o r d e r e d

th e p r o d u c in g p a r t y

to p r o d u c e e le ctr o n i c d o cu m e n ts

sh o u l d p r o d u c e th e e le ctr o n i c d o c u m e n ts w ith th e ir met a da ta in ta c t” [ 3 ] d u r in g a la wsu it a g a in st Sp r i n t.

I n v e stig a t o r s ca n u se th e h id d e n a ttr ib u te s a n d in f o r ma t io n sto r e d w ith d o c u m e n ts to ai d i n t h e o v e r a ll f o r e n sic a na ly sis p r o c e ss. T h i s p a p e r w ill a d d r e ss o n e sma ll p o r t io n o f th e d o c u me n t f o r e n si c s p r o c es s an d f o cu s o n th e d i sc o v e r y, a na ly sis, a n d u s ef u ln e ss o f me ta da ta sa v e d wi th d o c u me n t , p r e se n t at io n , a n d sp r e a d sh ee t a p p l ic a tio n s in w id e - u se to d a y.

2 . W H AT I S M ETA DATA?

A s me n tio n e d p r e v io u sl y, met a d ata c a n s imp l y b e d e sc r ib e d as d ata th a t d e sc r ib e s o th e r d at a. T h is i s a s imp l is ti c d e f in it io n f o r a ter m th a t is muc h mo r e c omp le x t h a n at f ir st sig h t. Me ta d a ta h a s b e e n u se d f o r ma n y y e a r s in a r a n g e o f a p p lic ati o n s. O n e ex a mp le o f th e u se o f meta d a ta is in we b p a g e s o n th e I n te r n e t . Meta d a ta em b ed d e d i n H T ML d o c u me n t s al lo w a sea r c h e n g in e t o c at a lo g th e t o p ic s a d d r e sse d a t t h e sp e cif i c site , th e r eb y in c re a sin g th e e ff ec tive n e ss o f se a r c h e n g i n e s in h o p e s o f in c re as in g th e tra ff i c to th e me ta d a ta u se r 's we b si te .

Me ta d at a is a lso u s ed b y re la ti o n a l d a t ab a se s in o r d e r to d e sc r i b e the ta b le s, c o lu m n s, a n d f ie l d s. I n th is c a se , the d a ta ba se meta da ta is re f er r e d to a s th e c a ta lo g o f t he d a ta b a se . I n a d d it io n , i t is u se d b y n e we r f ile sy s te ms t o s to r e in f o r ma t io n ab o u t th e d a ta t h a t is sa v e d o n t h e d isk . Fo r in sta n c e , th e L i n u x ex t 3 f il es y st em lo g s a ll f ile sy ste m d at a a n d me ta d a ta c h a n g e s in a jo u r n a l. Mic r o so f t f ile sy st ems, su c h as N T FS, also st o r e th i s ty p e o f in f o r ma t io n . I n a d d iti o n , o ld e r f ile sy ste ms, su c h a s L i n u x e x t2 a n d Wi n d o ws FAT 1 6 , sto re me ta da ta f il e in f o r ma ti o n s u ch a s time stam p s, siz e , a n d d a t a lo c a ti o n . E x t 2 a lso h a s th e c a p a b ilit y to s to r e p e rm issi o n s in f o r m a tio n f o r o w n e r s a n d g r o u p s .

Me ta d at a is u se d e xt e n siv e l y b y Mic r o so f t O ff ic e p r o d u c ts, O p e n O ff ic e . o rg ap p l ica ti o n s, a n d p o r t a b le d o cu m e n t f o r ma t ( PDF) d o c u me n ts i n o r d e r t o s to r e in f o r m a tio n su c h a s th e d o c u me n t ’s c r ea to r, d at e o f c re a tio n , da te a n d las t time it w a s sav e d , th e lo c at io n th e d o c u m e n t to w h ic h t h e d o c u me n t wa s sav e d , as w ell a s c o n tr ib u t o r s to th e d o c u me n t.

Me ta d at a is ve r y u se f u l at tim es a n d h e l p s t o f a ci lita te th e c o lla b o r ati o n a mo n g st ma n y p e o p le . I t a llo w s t h e a p p lic ati o n , in th i s c a se , to k ee p tra c k o f c h a n g e s a n d c om me n t s ma d e to a d o c u m e n t b y r ev i e we r s. T h e d o c u me n t a u th o r c an c h o o se to ac c e p t o r d e c li n e th e r ev i e we r re c o mme n d e d d o c u m e n t c h a n g e s a n d v ie w a n y c o mm en t s o ff e r e d .

A p r o b le m w ith t h e u se o f d o c u m en t me ta d a ta is t h a t ma n y

u se r s a n d d o c u m en t a u th o r s a r e n o t we ll ve r se d i n w h at in f o r ma t io n is sto re d w ith th e ir d o c u m e n ts a s t h e y sh a r e a n d

f in a ll y d istr i b u te th e m. U n le ss sp e cif i c me a su r e s a re tak e n to re m o v e th e d o c u m e n t’s me ta d at a, e v er y ti me a d o c u m e n t ,

sp r ea d sh e e t, o r p r e se n ta tio n is c re a te d in Mi c r o so f t Off ic e , o r

O p e n O ff ic e . o rg , as we ll a s PDF d o c u me n ts , meta d a ta is sa v ed al o n g sid e th e te x t c r ea te d b y th e a u t h o r.

T h is ty p e o f in f o r m ati o n c o u ld in a d v e r t e n tly d i sc lo se sen s iti v e in f o r m a tio n as w e ll a s p r o v e v e r y u se f u l to a c om p u te r f o r e n si c in v e sti g at o r. Se v er a l y ea r s a g o , me ta d ata w as sav e d w it h d o c u me n ts w ith o u t t h e c o n se n t o f th e c r eat o r ; h o w e v e r, r e ce n t d e v e l o p me n ts a n d a mo r e c o n ce n tr a ted f o c u s o n se c u r it y h a s le a d to th e u se r h a v i n g a ch o i ce o f w h e th e r t o sav e so me o f th e su sp e c t in f o r m a tio n w ith th e i r d o c u me n ts, b u t o n ly if th e u se r is sa v v y e n o u g h to k n o w a b o u t me ta d a ta .

3 . METAD ATA A PPLI ED

T h is se c tio n a d d r e sses th e sp e ci f ic f u n c t io n a l f eat u r e s o f d o c u me n t s, sp r ea d sh e e t s, a n d p r e se n ta tio n s c re a te d i n Mic r o so f t O ff ic e a n d O p e n O ff ic e . o rg , as we ll a s PD F

d o c u me n t s. I n a d d iti o n , t h is sec ti o n w ill b r ea k d o w n so me o f th e r isk s asso c iat e d wi th me ta d a ta a n d to t h e u se r a n d b e n e f its o f me ta d a ta f o r th e f o r e n sic e x a min e r. Fi n a lly, th i s se c tio n w ill a lso p r o v i d e e x a mp le s th a t h a v e lea d to s o me

em b ar r a ssi n g d isc o v e r ie s.

T h e p r o b l em w ith me ta da ta is n o t n e c e ssa r ily w ith t h e

me ta d a ta it se lf . As men t io n e d p r e v i o u sl y, me ta d a ta ha s u se f u l

p u r p o se s; h o we v er th e p r o b le m o c c u r s wh e n u se r s a re

ca re le ss o r u n i n f o r me d . A f te r o n e h ig h ly p u b l ic iz e d in sta n ce

o f me ta da ta r e ve a lin g in f o r m a ti o n n o t i n te n d e d f o r p u b l ic u se ,

o n e in d i v i d u a l st a te d th a t “ [ t] h e r ea l sc a n d a l is t h a t af te r 1 5 y ea r s o f u si n g M ic r o so f t Wo r d , I d o n ' t k n o w h o w t o tu r n o ff ‘ tra ck c ha n g e s’ [ 4 ] . ”

T h is p r o b le m is w id e sp r e a d a n d c o n t in u e s to a ttr ac t mu c h at te n tio n . Fo r i n st an c e , Sim o n By e r re se ar c h e d t he p r o b le m a n d p e r v a si v e n e ss o f meta d ata i n Mic r o so f t O ff ice d o c u me n t s. T h r o u g h a n e x h a u st iv e ex am in a tio n o f o v e r

1 0 0 , 0 0 0 d o c u me n t s, h e f o u n d t h at ab o u t ha lf o f th e

d o c u me n t s c o n t ain e d b e tw ee n 1 0 a n d 5 0 h id d e n wo r d s , a th ir d o f the d o c u me n t s h a d so me w h e r e b e tw e e n 5 0 a n d 5 0 0

w o r d s, a n d a p p r o x i ma te ly 1 0 pe rc e n t h a d mo r e th a n 5 0 0 h id d e n w o r d s c o n ta in e d w ith in t h e d o c u me n t [ 5 ] .

3 . 1 Ri s ks ( User) / Ben ef it s ( Ex a m in er)

A ll meta da ta sto r e d w ith d o c u me n ts , sp r e a d sh ee t s, a n d

p r e se n t at io n s c a n r ev e a l in f o r m a ti o n a b o u t th e d o c u m en t t h at

is b e n e f ic i al to th e i n v e stig a to r. H o w e v e r, th e r e a re f e a tu r e s

a n d c a pa b il it ie s o f Mic r o so f t O ff ic e , Op e n Off ic e . o rg , a n d PDF d o c u me n t s t h a t c a n mo r e so p o se p r o b le ms f o r a u se r b u t assist a f o r en s ic in v e st ig a to r in th e p e r f o r ma n c e o f h is o r he r d u tie s. T h e Tr ac k Ch a n g e s f e at u r e o f Mic r o so f t O ff i c e a n d

O p en O ff ic e . o rg wi ll be h i g h li g h t e d in th i s se c tio n as w el l as

th

e Co mme n ti n g f ea t u re , wh i ch is c ommo n t o Mic r o so f t

O

ff ic e, O p e n O ff i ce . o rg , a n d PD F d o c u me n t s.

Tw o ad d i tio n a l f ea t u r es o f Mi cr o s o f t O ff ic e th a t c a n p r o v i d e

u

s ef u l in f o r m a tio n a r e th e me ta da ta sto r e d w ith Ma cr o s a n d

F

as t- S av e s. I n a d d i tio n , o ld e r v er s io n s o f Mic r o so f t O ff ic e

s to r e d c o m p u te r s p ec i f ic in f o r ma tio n w ith it s me ta d a ta th a t

d e se r v e s me n tio n i n g , sin c e it r e v ea l ed mu c h mo re u se r-

s p ec i f ic i n f o r mat io n . PD F d o c u me n ts a lso c o n ta in me ta d at a , mu c h o f w h ic h w a s sto r e d w ith th e o r ig i n a l d o c u m e n t, b u t c a n a lso sto r e a d d it io n a l inc r imi n a ti n g in f o r ma tio n .

3 . 1. 1 Tra c k C h a n g e s a n d C o mme n t i n g

M ic r o so f t O ff ic e a n d Op e n Off ic e . o rg h av e Tr ac k Ch an g e s

a n d c o mme n tin g f ea t u re s tha t a r e a v a lu a b l e a d d i tio n w h e n

u

s ed p r o p er l y a n d d il ig e n tly. N e ith e r f e a tu r e i s e n a b le d b y

d

e f a u lt i n e i th e r o f th e p r o d u c ts; h o we v er, i ts u se b y

d

o c u m e n t c re a to r s a n d r e v ie we rs c a n r e v e a l mo r e i n f o r ma tio n

th a t p o ssi b l y d e si re d .

T h e Tra c k Ch a n g e s fe a tu r e p r o v i d e s a f a ci lity to v ie w th e

h isto r y o f a ll t h e c h a n g e s mad e to a d o c u me n t . I f th i s fe at u r e

is le f t e n a b l ed b y t h e u se r, all v i e we r s o f th e d o c u me n t w ill

h a v e t h e ca p a b il ity t o v i e w a ll c h a n g es ma d e sin ce th e la st

r o u n d o f c ha n g e s we r e ac c e p te d b y the d o c u m e n t c r e ato r [ 6 ] .

Bo th p r o d u c ts’ c o mmen t in g me c h a n ism lik e wi se c a n r e v e a l

th e sa me ty p e o f in f o r m a tio n . I t al lo w s u se r s to ma ke

c o mme n ts to t h e d o c u me n t wi th o u t c ha n g i n g a n y o f th e

u n d e r ly i n g d at a c o n t e n t. H o w e v e r, if th o se c o mme n ts ar e le ft

in , e ac h su b se q u e n t v i ew e r c a n re v i e w a ll th e c o mme n t s ma de

b y d o c u me n t r ev i e we r s. O f g r ea te r co n c e r n wi th th i s f ea t u r e

is th a t E x c e l a n d Po w e r Po i n t d o n o t wa r n a u se r o f th e c o mme n ts th a t ar e embe d d e d in a d o c u me n t [ 6 ] .

W h e n u sin g th e Tr a c k Ch a n g e s a n d c omme n t in g fe at u r e s, th e

n a me o f th e re v i ew e r is a lso sto re d w ith an y c omme n t o r

c h a n g e mad e to th e d o c u m e n t. N ee d le ss to sa y, th is c a n b e

h ig h l y u n d e si r a b le to p u b li c ly r ele a se th i s in f o r ma t io n , a s a c o m p an y ma y n o t w is h o t h e r s to k n o w ev e r y p er s o n w h o h a s r e v i ew e d th e d o c u me n t f o r re l ea se .

A s me n t io n e d p re v i o u sl y, t h e d o c u m en t p r o p e r tie s ca n r e v e a l

a tre me n d o u s a mo u n t o f i n f o r mat io n . I n b o t h o ff ic e p r o d u c t s

a d d r e sse d in th i s p a p e r, p a r t o f th e me ta da t a sa v e d wi th th e

d

o c u m e n t in c lu d e s th e n a me o f th e d o c u me n t c r ea to r. I f th i s

d

o c u m e n t is u se d a g a in as a te m p la te f o r a n o t h e r d o c u me n t,

th e c r ea to r 's n ame may sta y th e same ; h o w e v e r, th e au t h o r

ma y n o t. I n t h is c a se, a p u b l ish e d d o c u me n t ma y c o me f r o m

o n e o rg a n iz a tio n , b u t in r e a lit y o r ig i n a t e d f r o m a n o t h er to ta l ly

se p a ra te en t ity.

3 . 1. 2 Ma cro s a nd Fa st - Sa ve s

M ac r o s u se d w ith in o ff i c e p r o d u c ts ca n b e v e r y u se f u l a n d

in c r ea se p r o d u c ti v it y in ma n y situ a tio n s. H o we v e r, Mic r o so f t

O ff ic e a d d s a n a d d i tio n al b i t o f i n f o r ma t io n to a n y ma cr o

u s ed in sid e o f th e d o cu m e n t , sp r e a d sh e e t, o r p r ese n t a ti o n –

th e n a me o f the ma c r o a u t h o r [ 7 ] . T h i s is a g o l d min e f o r th e

f o r e n sic e xa min e r in v e st ig a tin g ma cr o v ir u s es t h a t f l o o d th e

I n te r n e t a t a n a la rmi n g r ate .

M ic r o so f t O ff ic e al so h a s t he ca p ab il it y t o p e r f o r m fa st- sa v es ,

w h ic h is a c o n v e n ie n t w a y f o r t h e u se r to e n su r e th a t if t h e

c o m p u te r c ra sh e s, a re c e n t b ac k u p i s ju st a cl ic k a wa y. T h i s c a n b e a we a lt h o f in f o r ma t io n f o r th e i n v e stig a to r. I f th e u se r

ty p e s u p a d o c u m e n t, w h il e f a st- sa ve s a re e n a b le d , a n d d e l ete s

s o me te x t, t h at d e le te d te x t is li k ely to sta y w ith the d o c u m e n t

th r o u g h o u t its li fe tim e. So me te x t is j u st n e v e r d e le te d [ 5 , 6 ] .

3 . 1. 3 Co mp u te r S p e c i f i c In f o r m a t i o n

I n Mi c r o so f t O ff ic e 9 7 , Wo r d , E x c e l, a n d Po we r Po i n t st o r e d a u n i q u e id e n tif ie r th a t c o u l d id e n ti f y th e sy st e m a n d in sta ll ati o n o n w h ic h th e d o c u me n t, sp r e a d sh e e t, o r p r e se n t at io n wa s c re a te d . Mi c r o so f t’s r ea so n in g f o r in c lu d i n g th is in f o r m a t io n in th e f il e wa s to f ac il ita te th e c o o p e r a ti o n w ith th i r d - p a r t y p r o g r a ms [ 8 ] . Mic r o so f t f u r th e r sta te d t h a t th e G lo b a lly U n iq u e I de n t if ie r ( G UI D ) n u m b e r, w h ic h h a s b ee n d e f in e d in RFC 4 1 2 2 [ 9 ] , c o u l d n o t b e u se d t o “i d e n tif y th e a u t h o r o f a d o c u me n t w ith o u t in t ima te k n o w le d g e o f t h e p e r so n a l c o mp u te r o n w h ic h t h e d o c u m e n t wa s o r ig i n a lly cr e a te d . ” H o we v e r, th e met h o d u se d to c re a te th e G UI D d id n o t c o m p le tel y c o in c id e w ith Mic r o so f t’s state me n ts a n d p r o v e d v al u a b l e d u r i n g th e se a r c h f o r th e a u th o r o f t h e Me lissa v ir u s.

W h a t ma k e s t h e G U I D n u mb e r so r ev e a lin g i s th a t it is c om p o se d o f th e c o mp u t e r ’s E th e r n et M ed ia Ac c e ss Co n t r o l ( MAC) a d d r e ss. T h e r e ar e n o tw o MA Cs al ik e a n d th e sto r a g e o f th i s ty p e o f in f o r m ati o n c o u l d le a d in v e st ig a to r s w ith su p p o r ti n g e v i d e n ce d ir e c tl y to th e c o mp u te r w ith wh i c h th e d o c u m e n t wa s c re a te d . T h e maj o r d r a w b ac k in u sin g th i s id e n ti f ie r in f o r en s ic in v e st ig a tio n s is th a t t h e GU ID is o n ly sto r e d o n c e w h e n a d o c u m e n t, sp r e a d sh e e t, o r p r e se n ta ti o n i s cr e a te d . T h e re f o r e , if th e d o c u me n t wa s mo d i f ied b y a n o th e r u se r, th a t n e w u s er ’s G UI D w o u l d n o t b e sto r e d in th e d o c u me n t a n d w o u ld o n ly c o n t a in th a t o f t h e o r ig i n a l d o c u me n t c r eat o r [ 1 0 ] .

3 . 1 .4 PD F D o cu men t s

PDF d o c u me n ts ar e w id e l y u se d a s a met h o d o f d istr ib u ti n g d o c u me n t s in a co mmo n f o r ma t re a da b le cr o s s- p l at f o r m. A s su c h , th e c a pa b il iti e s a n d f e at u r e s o f th i s d o c u m e n t f o r ma t al so p r e se n t a f o r e n si c c ha lle n g e to the e x a min e r a n d r isk t o th e u se r. A d o b e h a s a p lu g i n th a t is d e sig n e d to w o r k seam lessly w ith Mi c r o so f t O ff ic e a n d O p e n O ff ic e . o rg p r o d u c ts. T h is se a mle ss f u n c t io n a lity is o f a g r e a t b e n e f i t to th e u se r, b u t c an a lso p o se a ch a l le n g e re g a r d in g sto r e d me ta d a ta .

W h e n a d o c u m e n t is c o n v e r te d t o PD F f o r ma t, b y d e fa u lt, it is e na b le d to a lso sto r e a ll o f th e me ta d a ta th a t wa s sto re d w ith th e o r ig i n a l d o c u me n t, su c h as v e r sio n in f o r ma ti o n , th e d o c u me n t ’s c r ea to r, as we ll a s c h a n g e tr ac k in g . Al l o f t h e r isk s me n ti o n ed ab o v e r e g a r d in g th e Tr ac k Cha n g e s a n d c om me n t in g f ea t u re s a re a lso a n in h e r en t r isk to PD F d o c u me n t s. A d o b e a lso h a s a c o mme n t in g f e at u r e o f its o w n th a t c a n a lso a d d to t h e a mo u n t o f we a lth o f met a da ta st o r e d w ith th e d o c u me n ts.

O n e ad d i tio n a l f ea t u r e, n o t e n a b le d b y de f a u lt , w h e n in te r a c ti n g w ith Mic r o so f t Wo r d i s th e a b il ity to sto r e th e so u r c e d o cu m e n t in sid e o f t h e PD F f ile . I t is e asy to se e th a t th e b e n e f it s g a in e d e ve n if t he u se r c h o se n o t to c o p y o v e r t o so u r c e d o c u m e n t’s meta d a ta wh e n pe r f o r m in g th e f ile c o n v e r sio n w o u l d b e n e g a te d i f t h e u se r d id n o t u n d e r st a n d th e c a pa b ili ti e s a n d ri sk s a sso c iate d w ith st o r in g th e so u r c e d o c u me n t w ith th e PDF d o c u m e n t .

3 . 2 Met a da t a – Em ba r ra ss i ng Mom ent s

Me ta d at a ca n p r o v e to b e a u s ef u l me d iu m in h e l p in g a f o r e n sic i n v e stig a to r me et h is o r h e r o b je c ti v e w h ile , a t th e same t ime , le a d in g to r e g r e tta b le si tu a tio n s f o r d o c u me n t cr e a to r s a n d r e v ie we r s. T h i s se ct io n w ill f o c u s o n t h e mo re fa m o u s d is co v e r ie s ma d e th r o u g h th e e x p l o ita ti o n o f d o c u me n t meta d ata .

3 . 2 .1 M e rck

T h e p h a r ma ce u tic al co m p a n y Me r c k h a s b e e n in v o l v e d in sev e r a l la wsu it s r ela te d to its a r th r itis d r u g me d ic at io n . I n D ece m be r 2 0 0 5 , th e Ne w E n g l a n d J o u rn a l o f Me d ic in e

d isc o v e r e d th a t imp o r t a n t in f o r ma tio n r e ga r d in g th e

me d ic a tio n ’s r i sk o f c a u sin g h e a r t at tac k s wa s r e mo v e d f r o m a d o c u m e n t se n t b y Me r c k . Me rc k ap p a r e n tly h a d u se d th e

Tra c k Ch an g e s f ea tu r e w h ile p re p a r in g th e i n f o r ma tio n a l

p a p e r t o be re le ase d to th e Jo u r n a l . T h e a u t h o r s a t Me rc k f o rg o t t o a c c ep t th e c ha n g e s ma d e to th e d o c u m en t a n d

s u b se q u e n tl y re le a se d it w ith a ll th e me ta d ata in ta c t . U p o n c l o se r in v e stig a tio n , th e J o u rn a l d isc o v e r e d t he d e le ti o n a n d s u b se q u e n tl y re lea sed th e in f o r ma t io n a b o u t th e Me r c k ’s g a ff e

[ 11 ] .

3 . 2. 2 Dem o cr a t ic Na ti o n a l Co m mit t e e

A d o c u me n t su r f a ce d f r o m th e D N C i n la te Oc to b e r 2 0 0 5

w ith so me n o t so fla tte r in g th i n g s t o sa y a b o u t S u p r em e Co u r t n o mi n e e Ju d g e Samu e l Al it o . Af t er e xa min a ti o n o f th e d o c u m e n t 's me ta da t a, a fe w o f th e a u th o r 's n a me s we re r e v e a le d as we ll a s t h e cr ea ti o n d a t e o f th e d o c u m e n t. Mo r e

s p ec i f ic a lly, tw o u se r id s we r e d i sc o v e r e d a n d e q u a te d t o t wo

me mb er s o f t h e D N C a n d th e d o c u m en t wa s c r ea te d r ig h t

a f te r Ju sti ce O 'Co n n o r re sig n e d , me a n in g th a t th e d o c u me n t w a s c r ea te d b e f o r e Ju d g e A lit o w a s n o mi n a te d [ 5 ] .

3 . 2. 3 Un it ed Na ti o n s

I n Oc to b e r 2 0 0 5 , t h e U n ite d Na ti o n s ( U N ) r e le a se d a n

u n e d i te d re p o r t re g a r d in g Sy r ia ' s in v o l v e m en t in t h e a ssa ssin a tio n o f th e f o rme r Pr i me Min i st e r o f L e b an o n . A c h a n g e wa s ma d e to th e r e p o r t a f te r i t wa s g iv e n t o th e UN

Ch ie f , b u t it w as still v isib l e w h e n a n in q u ir i n g mi n d c he ck e d

th e Tr ac k Ch a n g e s f u n c ti o n o n th e d o c u me n t .

S o me o n e c h an g e d t h o se r e sp o n sib l e f o r d e v i si n g th e a ssa ssin a tio n f r o m t h e b r o t h e r an d b r o t h e r- i n - la w o f th e S y r ia n Pr e sid e n t , as we ll as o th e r h ig h r a n k in g o ff i c ia ls, to a g e n e r ic “ se n i o r Le ba n es e an d Sy r ia n o ff i c ia ls” sta te me n t . T h e in a d v e r t en t d isc lo su r e o f th i s in f o r m ati o n o cc u r r e d o n ly b e c a u se th e d o c u m en t a u th o r s we re n o t ca re f u l in ch ec k in g th e t y p es o f me ta d a ta c o n ta in e d w ith i n the d o c u m en t b e f o r e r e le a se [ 4 , 1 2 ] .

3 . 2. 4 S C O G ro u p

A n o th e r e x am p le o f th e in a d v e r te n t d isc lo su r e o cc u r r e d in

2 0 0 4 w h e n th e SCO g r o u p f ile d a la wsu it ag a in st

D a ime r Ch r y sl e r a n d A u to Z o n e . O n c e a ga in , th e te x t o f t h e la wsu it h a d b e e n c re a te d u sin g Mic r o so f t Wo r d w ith Tr ac k

Ch a n g e s e na b le d . T h e a u t h o r d id n o t tak e th e st ep s n e c e ssa r y

to r em o v e a ll th e c ha n g e s a n d c omme n ts b e f o r e th e d o c u me n t

w a s r e le a se d . I t wa s su b se q u e n tl y d i sc o v e r ed th a t th e d o c u m e n t wa s o r i g in a lly p r ep a r e d wi th Ba n k o f Ame r ic a a s th e d e fe n d a n t [ 4 , 1 3 ] .

3 . 2. 4 Th e “Do d g y Do ss i e r”

O n e o f t h e mo re f am o u s fa u x - pa s th a t h a s ta k e n p l ac e in r ec e n t y ea r s wa s b r o u g h t to li g h t i n 2 0 0 3 . T h e U n ite d K in g d o m c o u r t s su mmo n e d d o c u me n ts f r o m i ts g o v e r n me n t r e g a r d in g I ra q ’s o f w e a p o n s o f mass d e str u c tio n p r o g r a m. A mo n g th e d o c u m e n ts p r o v i d e d to t h e c o u r ts wa s o n e tha t a p p e ar e d to b e g e n u in e a n d ma de a c ase f o r H u sse in 's p o s se ssio n o f th e se we a p o n s . Ho w ev e r, u p o n f u r th e r e x a min a tio n , it w a s d isc o v e r e d a la rg e p o r t io n o f th e d o c u m e n t w as a c tu a lly ta ke n f r o m a tw elv e y ea r o l d Ph D th e si s. Fo u r o f th e d o c u me n t au t h o r s' n a me s w er e d i sc o v er e d , p u tt in g the m u n d e r th e s p o tli g h t in o r d e r to asce r t ain h o w th is in f o r m a t io n wa s c o m p ile d [ 1 4 ] .

3 . 2. 5 Th e Me l i ss a Vir us

O n Ma r c h 2 6 , 1 9 9 9 , th e Me li ssa v ir u s wa s u n le a sh e d o n t h e

I n te r n e t a n d s p r ea d w it h a ma zin g sp e e d . Mill io n s o f u se r s w e r e a ff e c te d a n d c om p a n ie s estima te d t h e ir lo s ses in th e

mi lli o n s o f d o ll a r s. T h e f e d e ra l g o v e r n me n t lo o k e d to f in d

a n d p r o se c u te th e v i r u s’s c re a to r b e ca u se o f i ts w id e sp r e a d im p ac t. T h i s w a s n o t a n e a sy tas k b u t wa s a ide d b y tw o in d e p e n d e n t p e r so n s w h o d isc o v e r e d so m e d a ma g in g in f o r ma t io n [ 1 5 , 1 6 ] .

T h e se p e r so n s lo o k e d a t t h e meta d a ta i n si d e o f th e d o c u m e n t c o n ta i n in g th e v ir u s a n d d isc o v e r e d t h e G U I D . T h e in v e stig a to r s c o n d u cte d f u r t h e r r e sea rc h a n d f in a lly loc a te d a w eb s ite b e lo n g i n g t o a ma lic io u s h a c k e r, o n wh i c h o th e r d o c u me n t s wi th th e same GU I D we re d isc o v e r e d . W h ile th i s c o u ld n o t b e u se d in a n d o f itsel f t o p in p o in t o n e i n d iv i d u a l a s th e c re a to r, c om b in e d w it h o t h e r in f o r ma tio n , it ca n d e f in i te ly h e lp the in v e st ig a t io n . I n th e e n d , th e d isc o v e r e d in f o r m ati o n w as pa sse d to Z D Ne t, w h o p u b li sh e d sev e r a l a r t ic le s, a n d th e fe d e r al a u th o r it ie s. T h is in f o r ma tio n a ssisted in eff o r ts to fi n d a n d c o n v i ct Da v id Smith o f A b e r d e e n , N. J. , f o r cr ea ti n g t h e v ir u s.

4 . MIC RO SO FT OF FI CE M ETA DATA

Mic r o so f t O ff ic e is th e mo st d o mi n a n t o ff i ce p r o d u c t in u se to d a y. Be ca u se o f th is f ac t , t h e me ta d a ta t h a t is u se d b y it s c om p o n e n t p r o d u c ts , Wo r d , E xc e l, a n d Po w e r Po i n t, h a s b e e n in c r ea sin g l y sc r u ti n iz e d in p r e v io u s y e a rs a n d e x te n siv e ly a d d r e sse d b y Mic r o so f t.

A cc o r d i n g t o Mic r o so f t ’s K n o w le d g e Ba se [ 1 7 , 1 8 , 1 9 , 2 0 ] , th e f o ll o wi n g d at a c a n b e sa v e d a s h id d e n in f o r m at io n in sid e o f Mi c r o so f t O ff ic e d o c u me n ts , sp r e a d sh e e ts, a n d p r e se n t at io n s:

H id d e n I n f o r ma ti o n ( Po w e r Po i n t)

Yo u r c o mp a n y o r o rg an i z a t io n n am e ( Al l)

T h e n a me o f y o u r c o mp u t e r ( Al l)

T h e n a me o f the n e tw o r k se r v e r o r h a r d d isk w h e re y o u sa v e d th e d o c u me n t ( A ll)

O th e r f ile p r o p e r tie s a n d su m ma r y in f o r m a tio n ( Al l)

N o n - v isib le p o r ti o n s o f em be d d e d O L E o b je cts (A ll)

T h e n a me s o f p r e v io u s a u th o r s ( A ll)

D o c u me n t r e v isio n s ( Wo r d , E x c e l)

D o c u me n t v e r sio n s ( Wo r d )

Tem p la te in f o r m ati o n ( Wo r d , Po we r Po i n t)

H id d e n te x t ( Wo r d , E x c e l)

H id d e n Cel ls (E x c e l)

Pe r so n a li ze d v ie w s ( E x c e l)

Co mme n ts ( A ll)

G lo b a l ly Un i q u e I d e n tif i e r s ( GU I D s) ( Al l)

Yo u r n a me ( A ll) Yo u r in i tia ls ( A ll)

N ex t to e a c h ide n tif i ed ty p e o f sto r e d me ta d a ta , a d e sig n a tio n w as ma d e to d isti n g u ish th e in f o r m a tio n th a t ma y b e u n i q u e to ea c h Mi c r o so f t Off ic e p r o g r a m. W h e re th e me ta d a ta ca te g o r y a p p l ie s to al l p r o g r am s, the d e sig n a ti o n re f l ec ts th a t fa c t. I n f o r ma tio n su c h as t h is c an p r o v e v e r y h e l p f u l to a f o r e n sic in v e st ig a to r a s we ll as a n y o th e r p e r so n in v o l v e d i n re c o n n ai ss an c e a ct iv itie s. I n e ith e r c a se , a p e r so n c o u l d p o ssi b l y d e te r mi n e th e a u t h o r o f th e d o c u m e n t, a s we ll as h is o r h er u se r id , a n d th e n et wo r k p a th lo c at io n o f t h e o r ig i n a l d o c u me n t . Th i s in f o r m a ti o n c o u ld b e u se d to ma p at le a st a smal l p o r ti o n o f n e t wo r k ’s la y o u t.

Mic r o so f t Wo r d , Ex c e l, a n d Po w e r Po i n t h a v e a d d e d f ea tu r e s th a t f ac ili ta te c o o p e r a tio n a mo n g d o c u m e n t a u th o r s th r o u g h th e u se o f th e Tra c k Ch an g e s a n d Co mme n ts fe a tu r e s. I f a d o c u me n t a u t h o r p u b lish e s a d o c u me n t w ith o u t ta k in g me asu r e s to r e mo v e a ll c o mme n ts a n d c ha n g e s f r o m th e d o c u me n t , h e o r sh e c o u ld re v e al a ll t he c o n t r ib u t o r s to th e d o c u me n t a s we ll as it s o r ig i n al in f o r ma t io n ; a ll o f w h ic h c o u ld lea d to t he e x p o su r e o f d a ta th a t wa s n o t me an t to be

se en b y a n y o n e , mu c h le ss th e f o r e n sic in v e st ig a to r.

I t is eas y to se e h o w th e se t y p e s o f c a pa b il it ie s c a n b e u se f u l

to

d o c u m e n t a u th o r s. I t c a n a llo w th e r ea d e r t o ta k e n o ti c e o f

th

e c re a to r as w ell as f a c il ita te co l lab o r a tio n am o n g se v e r al

a u t h o r s. I n v e r sio n s p r io r t o M ic r o so f t O ff i ce 2 0 0 3 , th e p r o b le m is tha t a ll in f o r m a t io n is sto re d in a p r o p r ie ta r y b in a r y f o rma t. He n c e, th e u se r h a d v ir tu a l ly n o wa y t o k n o w

w h at me ta d a ta w as sto r e d w ith th e d o c u m e n t. E v e n th o u g h

M ic r o so f t O ff ic e 2 0 0 3 d o e s o ff e r th e ca p ab il it y to sa ve the

in f o r m a t io n in th e mo re w id e ly ac ce p te d XML f o r ma t, th e

b in a r y f o r ma t is st il l th e d e f a u lt a n d th e n o n - tec h n ic a l u se r ma y n o t be a wa re o f th e ex t e n d ed c a pa b ilitie s in the n e w e r f o r ma t.

5

. O P ENO F FI CE. O RG META DATA

O

p en O ff ic e . o rg ’s o ff i c e p r o d u c t ha s in c re a se d i n p o p u la r i ty

o v e r th e p a st se v e r al y e a r s a n d h a s ta k en a d iff e r e n t a p p r o a c h to it s f ile f o r ma t. O p e n O ff ic e. o rg sto r e s a ll th e d o c u me n t d a t a, t o i n c lu d e meta d a ta , in a se r ie s o f X ML fi les th a t a re a sso c ia te d w ith t h e o v e r a l l f il e n ame g iv e n b y th e u se r.

O p en O ff ic e . o rg o u tl in e s in its X ML f ile f o rma t sp e c if ic at io n

[ 2 1 ] th e c a pa b il it y t o sto r e a lo t o f met ad a ta in sid e o f it s d o c u m e n t s, sp r ea d sh e e t , a n d p r e se n t ati o n s to in c lu d e :

Ge n e ra t o r ( A ll)

Title ( A ll)

De sc r ip ti o n ( Al l)

Su b jec t ( Al l)

Ke y wo r d s ( Al l)

Pr in te d By (A ll)

Cr ea ti o n Da te an d Time ( A ll)

Mo d if ic a t io n Da te an d Time ( A ll)

Pr in t Da te a n d Time ( Al l)

D o c u me n t Tem p la te ( A ll)

L a n g u a g e ( A ll)

E d i tin g D u r a tio n ( A ll)

U se r- d e f in e d Me ta d a ta ( A ll)

D o c u me n t Sta t istic s ( A ll)

I n it ia l Cre at o r ( A ll) Cr ea t o r ( A ll)

A c co r d i n g t o t h e sp e ci f ica t io n d o c u me n t [ 2 1 ] , all o f th e a b o v e

c a te g o r ie s a r e sto r e d , o r h a v e th e ca pa b ility t o b e sto r e d , w ith e a c h d o c u me n t , sp r e a d sh e e t, a n d p r e se n t at io n cr ea te d in

O p en O ff ic e . o rg . T h i s i s mu c h o f th e sa me ty p e o f

in f o r m a t io n th a t is sto r e d b y Mic r o so f t O ff ic e ; h o we v e r,

O p en O ff ic e . o rg d o e s n o t ma ke a ssu m p tio n s a b o u t w h a t

p e r so n a l in f o r ma ti o n th e u se r w o u ld li k e asso c iat e d wi th th e

f il e. Fo r i n st a n ce , if a u se r d o e s n o t en t e r in a n am e in th e a p p l ic a ti o n 's u se r in f o r m a tio n w id g e t, th e p r o g r a m w ill n o t tr y a n d g e t t he r e g istr a ti o n in f o r ma ti o n f r o m th e o p e r at in g sy st em

in o r d e r to d is co v e r t h e n ame o r in i ti a ls o f t h e u se r.

A s wi th Mic r o so f t O ff ic e , O p e n O ff i c e. o rg h a s th e ca pa b il ity

to sto r e in f o r ma t io n fa c ili ta t in g th e u se o f t h e Tr ac k Ch a n g e s u ti li ty a n d c o mme n t in g fe at u r e s. O p e n O ff ic e . o rg p r o v i d e s

e a sie r a c c ess to a fi les me ta da ta d at a, w h ic h fa ci lita te s u se r

a n d e x a mi n e r d is co v e r y, g iv e n h e o r sh e k n o w s w h a t th e y ar e

lo

o k i n g f o r. O p e n O ff ic e .o rg sto r e s th e me ta d a ta a sso c ia te d

w

ith th e o v e ra ll d o c u me n t, sp r e a d sh e et , o r p r e se n ta tio n in a

se p a ra te p la in te x t f ile f o r e a sie r a c c ess. T h e sp e c ifi c f o r ma t

o f th e meta d ata a n d file s tr u c t u r e w ill b e d i sc u ss ed in a la te r

se cti o n .

6 . PDF M ETA D ATA

P DF d o c u me n ts sto re me ta da ta in f o r m a tio n a lso t h a t, a s me n tio n e d b e f o r e , is so me times c o p i e d o v e r f r o m t h e o r ig i n a l

so u r c e d o c u me n t s f r o m w h ic h th e PDF wa s c r ea te d . T h e

ty p e s o f d a ta a n d f o rma t a re o u tl in e d in th e P D F Re fe re nc e M a n u a l v e rsio n 1 . 6 [ 2 2 ] , wh i ch sp e c i f ie s th a t the in f o r ma t io n is st o r e d in sid e o f a d o c u me n t in f o r m a ti o n li b r a r y.

Fu r th e r mo r e , th e in f o r m a ti o n i s lo c a ted in sid e o f a n o p ti o n a l

I n f o e n tr y in th e t ra ile r o f th e PDF f ile .

A s th e o t h e r p r o d u ct s men t io n e d p r e v i o u sly, i t h a s t h e

ca p ab i lit y t o sto r e mu c h o f th e sa me in f o r ma t io n , w h ic h

in c

lu d e s:

Ti

tle

 

A u th o r

Su b je c t

Ke y w o r d s

Cre

a to r

Pr o d u c e r

Cre

a

tio n D a te

Mo d

Da te

A d o b e Sy ste ms I n c o r p o r a te d is a l so p a r t o f an in iti a tiv e to

sta n d a r d iz e th e me ta da ta sto r e d in d o c u me n ts t o f ac ilit ate

g r ea te r ea se in th e s to r a g e a n d se ar c h i n g o f in f o r m ati o n in

d a ta ba se s a s w e ll as we b - b a se d e n v i r o n me n ts. T h i s e ff o r t is

ca

lle d th e E x t en s ib l e Me ta da ta Pla tf o r m ( X MP) [ 2 3 ] a n d o n e

sp

ec i f ic p u r p o se is to a llo w d iff e r e n t p r o g r a ms t h at p r o c ess

A d o b e f ile s to a d d the ir o w n ty p e s o f me ta d a ta ea c h st e p o f th e w ay. T h e ty p e o f in f o r m a tio n sto r e d as me ta da t a w ill n o t

c ha n g e , b u t o n ly t h e f o r ma t in wh i c h it is st o r e d u si n g a mo r e

ac ce ssib le X ML ty p e f o r ma t.

7 . METAD ATA F ORMATS

G iv e n th a t th e d i sc u ss io n h a s f o c u se d o n th e t y p e s o f in f o r ma t io n sto r e d a n d th e b e n e f it s a n d d isa d v a n ta g e s o f

me ta d a ta in o ff ic e a p p lic a ti o n p r o d u c t s, I w ill n o w p r e se n t

h o w t he meta d a ta is sto r e d in ea c h o f th e p r o g r a ms a d d r es se d in th i s p a p e r. E x a mp le s o f h o w th e d a ta is st o r e d a re p r e se n t e d , w h e n p o ssib le , to e ase d isc o v e r y b y th e f o r e n sic in v e stig a to r.

7 . 1 Micro s o f t Word , Ex cel , a nd Po wer Po i n t

(P re- XML)

Mic r o so f t v e r sio n s u p u n t il v e r y re c e n tl y o n l y st o r e d th e in f o r ma t io n f r o m Wo r d , Po w e r Po i n t, an d E x c el in a p r o p r i e ta r y b i n ar y f o r ma t c a lle d th e O b je ct L in k in g a n d Em b e d d i n g (O L E ) 2 p r o to c o l. I n t h is f o r ma t [ 2 4 ] , a ll in f o r ma t io n is wr i tte n in str ea ms th a t a r e sto r e d in th e b in a r y f ile as l in k e d l ists o f f ile b lo c k s. T h e met ad a t a is sto r e d f o r th e m o st p a r t in wh a t is c al le d th e S u mma r y I n f o r ma tio n an d D o c u me n t Su m mar y I n f o r m a tio n sto r a g e in f o r m a tio n str ea ms w ith in th i s fi le . T h e l imi te d a mo u n t o f sp ec i f ic in f o r m a ti o n o n th is f o r ma t p r e v e n ts a mo r e d e ta ile d a na ly sis o f th e sto r a g e lo c at io n s as in su b se q u e n t se c tio n s. T h i s b in a r y f o r ma t h as b ee n u se d b y a ll v e r sio n s o f Off ice .

Me ta d at a in th e se d o c u m e n ts is n o t e asil y v ie we d b y t he f o r e n sic i n v e stig a to r, mu c h le ss t he u se r. O n e ca n v ie w th e h id d e n i n f o r ma t io n sav e d w ith a d o c u me n t b y o p e n i n g u p the f ile w ith a h e x a d e c ima l v ie we r. T h i s w ill r e v ea l so m e o f th e h id d e n i n f o r ma t io n ; h o w e v e r, it is n o t p r a c tica l so lu t io n .

A mo r e co mmo n a p p r o a c h to v ie w in g me ta d a ta i n t h e o ld e r

v e r sio n s o f Wo r d , E x c e l, a n d Po w e r Po in t i s to u se a th i r d - p a r ty ap p l ica tio n . M an y o f th e se a p p li ca tio n s h av e b ee n ar o u n d f o r y e a r s a n d ca n p r o v i d e a g o o d su mmar y o f th e in f o r ma t io n c o n ta i n e d w ith i n th e se d o c u m e n t s. T h is p a p e r w ill d i sc u ss so me o f th e th ir d - pa r t y to o l s in a la te r se cti o n . T h e se to o ls c an a ssi st th e f o r e n sic i n v es tig a to r ' s eff o r ts to lo c at e meta d a ta in d o c u me n t s, to i n c lu d e th o se c r ea te d b y o ld e r v e r sio n s o f Mi c r o so f t O ff ic e .

7 . 2 Micro s o f t Wor d, Ex cel , a nd Po werP o in t ( New X ML Form a t )

A s o f Mic r o so f t O ff i c e 2 0 0 3 , the u se r is g iv e n t h e o p ti o n o f

sa v in g in th e n e w X ML f o r ma t th a t Mic r o so f t u se s in h o p e s

o f b r in g i n g it cl o se r to a mo re o p e n sta n d a r d s f o rma t. I t i s n o t

th e sa me as the O p e n D o c u me n t XML f o r ma t; b u t

n e v e r th e le ss, it s to r e s in f o r ma t io n in a mu c h mo r e a c ce ssib le

ma n n er th a n b e f o r e . A f te r O ff ic e 2 0 0 3 , th e X ML f o r ma t w il l b e th e sta n d a r d f il e f o r ma t ra th e r th a n ju st an o p ti o n .

W h e n sa v in g d o c u me n ts in th e n e w X ML f o r ma t, th e u se r o r

in v e st ig a to r c an ac ce ss t h e me ta d a ta b y v ie wi n g t he so u r c e

X ML f il e wi th a te x t e d ito r. T h e f o ll o wi n g is n o t me an t to b e

a n ex c lu siv e li st o f t h e in f o r ma t io n sto r e d , b u t me re ly a n

e x a mp le o f h o w the me ta d a ta i s sto r e d n ea r t he b e g i n n i n g o f a

te st Mic r o so f t O ff ic e 2 0 0 3 Wo r d XML f il e:

< o : D o c u m e n t P r o p e r t i e s >

< o : T i t l e > T h i s i s a t e s t < / o : T i t l e >

 

< o : A

u t h

o r

> J J

< /

o : A

u t

h o r

>

< o : L

a s t

A u

t h o

r >

J J <

/ o

: L a

s t

A u t

h o

r >

< o : R

e v i

s i

o n >

2 <

/ o :

R e

v i s

i o

n >

< o : T

o t a

l T

i m e

> 0

< / o

: T

o t a

l T

i m e

>

< o : C

r e a

t e

d > 2

0 0

6 - 0

2 -

2 6 T

0 2

: 0 6

: 0

0 Z <

/ o

: C r

e a t e d >

< o : L

a s t

S a

v e d

> 2

0 0 6

- 0

2 -

2

6

T 0 2 : 0

6 : 0

0 Z

< / o

: L

a s t

S a

v e d

>

 

< o : P

a g e

s >

1 < /

o :

P a g

e s

>

< o : W

o r d

s >

9 < /

o :

W o r

d s

>

< o : C

h a r

a c

t e r

s >

5 5 <

/ o

: C h

a r

a c t

e r

s >

< o : C

o m p

a n

y > S

e l

f < /

o :

C o m

p a

n y >

< o : L

i n e

s >

1 < /

o :

L i n

e s

>

< o : P

a r a

g r

a p h

s >

1 < /

o :

P a r

a g

r a p

h s

>

<

o

: C

h a r

a c

t e r

s W

i t h

S p

a c e

s >

6 3 <

/ o

: C h

a r

a c t

e r s W i t

h

S

p

a c e

s >

 

<

o

: V

e r s

i o

n > 1

1 .

6 5 6

8 <

/ o :

V e

r s i

o n >

 
 

<

/ o :

D o

c u m

e n

t P r

o p

e r t

i e

s >

A s sh o w n a b o v e , p le n ty o f in f o r m at io n is r e ad i ly a va ila b le to

a n y o n e w h o ca n v ie w th i s d o cu m e n t a s a p la in te x t f ile o r

w

ith an X ML e d i to r. Mic r o so f t b e g in s t h e me ta d a ta sec tio n

w

ith th e < o : D o c u m e n t P r o p e r t i e s > a n d c o n tin u e s w ith

f a i r ly se lf e x p l a n a to r y ta g s d e sc r ib in g th e d o c u me n t , a s w e ll a s th e a u t h o r s, a n d c o mp a n y i n f o r ma t io n . N e e d le ss to sa y,

th i s c a n b e h e lp f u l t o th e in v e stig a to r, a s we ll as t he n o r ma l

u s er, b ec au s e th e f ile c o n t e n t s a re a p p a re n t a s o p p o se d to th e

b in a r y f o r ma t d i sc u sse d p r e v io u sly.

7 . 3 M icro so f t ’s Ri ch Te xt Fo rm a t ( RTF )

M ic r o so f t’s RT F d o c u m e n ts h a v e b ee n i n ex i ste n ce f o r ma n y

Be f o r e d o c u me n t s we re e a sily t ra n sf e r a b le a n d

r ec o g n iz e d b y the mu l titu d e o f d o c u me n t c r ea tio n a n d e d i ti n g p r o g r a ms, th is f o r ma t fa ci lita te d cr o ss- p la tf o r m, cr o ss- a p p l ic a ti o n d o c u me n t sh a r in g . A s su c h , ma n y u s er s a re u n a w a r e o f th e i n f o r ma tio n th a t is sto r e d w ith th e se d o c u m e n t s. O n e mig h t b e lie v e th a t b e c a u se th is is a s imp l if i e d te x t f o r ma t, tha t mu c h o f th e meta da ta in f o r ma tio n

y e a r s.

is

n o t sto r e d w ith th e d o c u m en t a s wi th Wo r d ’s . d o c f ile s.

H

o we v er, th i s is n o t th e ca se .

M ic r o so f t sto r e s mu c h o f th e sa me t y p e o f in f o r ma ti o n in RT F

f il es [ 2 5 ] as it d o e s w ith th e n o r ma l Wo r d f ile s. A sa mp le f o r ma t is p r o v i d e d b e l o w a n d wa s e x t ra cte d f r o m a n RT F f il e o r ig i n a l ly c r ea te d in Mic r o so f t Wo r d 2 0 0 3 a n d the n sa ve d as a

RT F f ile :

{

\ i n f o

{ \ t i t l e D o c u m e n t T i t l e }

{ \ a u t h o r A u t h o r N a m e }

{ \ o p e r a t o r U s e r i d }

r e

{ a t i

\ c

m \

y r 2

0 0

6 \ m

o 4

\ d y

2 \

h r 7

\ m

i n 3

7 }

{ \ r

e v

t i m

\ y

r 2 0

0 6

\ m o

4 \

d y 2

\ h

r 7 \

m i

n 3 7

}

{ \ v

e r

s i o

n 2

}

{ \ e

d m

i n s

0 }

{ \ no fp a ge s5 }

{ \ no fw o rd s7 0 9}

{ \ no fc h ar s4 0 42 }

{ \ *\ co m pa ny Co m p a n y N a m e }

{ \ no fc h ar sw s 47 4 2 }

{ \ ve rn 2 45 79 }

}

W

h a t is in t e r estin g a b o u t t h e me tad a ta sto re d in RT F

d o c u me n t i s th a t it stil l k ee p s tra ck o f r e v isio n s a n d ve r si o n

n u mb e r s. T h e ta g s u se d b y t h e RT F f ile s ar e se lf - e x p l a n a to r y a n d ar e sa v e d w it h th e RT F d o c u me n t a u t o ma t ic a lly. I f a u s er

cr e a te s a RT F d o c u m e n t , o r sa ve s a Wo r d d o c u m e n t as a n

RT F f ile , th e meta d a ta c o n ta i n e d w ith in th e f ile w ill th e n al so b e c o n ta i n e d w ith i n the RT F d o c u me n t f ile .

7 . 4 Op en O ff i ce . o rg XM L

O p e n O ff ic e . o rg ta k e s a u n i q u e a p p r o a c h i n th e c re a tio n a n d

sto r a g e o f in f o r m a t io n in its n a tiv e XML f o r ma t. Ea c h time a

d o c u me n t , sp r ea d sh e e t, o r p r e se n t a tio n i s c r ea te d , a se r ie s o f f ile s ar e c re a te d a n d sto r e d in o n e a r ch i v e . I n sid e o f t h is

ar

c h iv e a re se v e ra l d iff e r e n t f il es th a t c o n ta in a ll th e

in

f o r ma t io n th e a p p l ica tio n re q u ir e s.

Fo r e x amp l e , w h e n a n O p e n O ff ic e . o rg te x t d o c u me n t is

cr e a te d , th e f o llo w i n g f ile s a re st o r e d in sid e o f th e . sx w f ile :

c o n te n t .x m l, meta . xm l, se tti n g s. x ml, a n d sty le s. x ml . T he r e

ar e a f e w mo re f ile s sto r e d , b u t th e y a r e n o t r e le v a n t to th i s

d isc u ssio n . I n o r d e r to v ie w th e c o n te n t s o f t h e se f ile s, th e

f ile s m u st b e e x t ra c te d o u t o f th e . sx w f ile , mu c h lik e a z ip f ile .

O

n ce th e f ile s a r e e x tr ac te d , it i s e v i d en t th a t th e me ta . xml f ile

is

th e mo st lik e l y c a n d id a t e t o c o n t a in t h e me tad a ta a sso c ia te d

w

ith th e d o c u me n t. T h e f o llo w in g is n o t me a n t to b e a n

e x h a u stiv e list o f t he in f o r ma ti o n s to r e d , b u t mer e ly a n e xa mp l e o f h o w t he me ta d a ta is sto r e d n ea r t he b eg i n n i n g o f a

te st O p e n O ff i ce .o rg Wr ite r d o c u me n t:

< o f fi ce : me ta >

< d c: ti t le >T i tl e < / d c: t i t le >

< d c: de s cr ip t io n > C o mm e n t </ d c : de s c r ip t i o n>

< d c: la n gu ag e >e n - U S </ d c : la n g u ag e >

< m et a: i ni ti a l- c r e a to r > N am e < / me t a : in i t i al -

c

r e a to r>

< m et a: c re at i on - d a t e> X < / me t a : cr e a t io n - d at e >

< d c: cr e at or > Na m e < / dc : c r ea t o r >

< m et a: g en er a to r > N e oO f f i ce < / m et a : g en e r a to r >

< d c: cr e at or > Na m e < / dc : c r ea t o r >

< m et a: k ey wo r ds > <m et a :k ey w or d > F i rs t < / me t a : ke y w o rd > <m et a :k ey w or d > S e co n d < /m e t a :k e y w or d >

< / me ta : ke yw o rd s >

< d c: da t e> X: < /d c : d a te >

< d c: su b je ct > Su b j e c t< / d c :s u b j ec t >

< m et a: p ri nt e d- b y > N am e < / me t a : pr i n t ed - b y >

< m et a: p ri nt - da t e > X </ m e t a: p r i nt - d a te >

< m et a: d ur at i on - t i m e> X < / me t a : ed i t i ng -

d

u r a ti on >

< m et a: e di ti n g- c y c l es > 4 < /m e t a :e d i t in g - c yc l e s

>

< m et a: e di ti n g- d u r a ti o n > X< / m e ta : e d it i n g -

d

u r a ti on >

< / o ff ic e :m et a >

T h is is ju st a sm a ll e xa mp le o f th e me ta d a ta sto r e d w it h O p e n O ff ic e . o rg d o c u m e n ts . T h e imp o r t a n t p o i n t to n o te

a b o u t met ad a ta in O p e n O ff ic e. o rg ' s d o cu m e n ts, p r e se n t at io n s, a n d s p r ea d sh e e ts , is th e ea se o f ac c e ss a ff o r d e d b y st o r in g al l o f th e in f o r m a t io n in th e me ta . x ml f ile . T h i s p r o v i d e s r ea d y

ac ce ss b y u se r s a n d i n v es tig a to r s to t h e we a l th o f in f o r m ati o n

th a t c a n be sto re d w it h th e O p e n O ff ic e . o rg o ff ic e p r o d u c ts.

7 . 5 A do be ’s PD F

A s men t io n e d p r e v io u sl y, Ad o b e ’s P DF d o c u me n t f o r ma tio n

h a s g a in e d in p o p u l ar i ty o v e r th e p a st se v e ra l y e a r s b ec a u se o f

th e c r o ss - p la tf o r m c a pa b ilitie s it a ff o r d s. Eac h t ime a PD F d o c u m e n t i s cr ea te d ; th e so u r ce d o c u me n t ’s me ta d a ta is c o p i e d a s w e ll as i n c o r p o r a t ed in t o A d o b e ’s f o r ma t f o r me ta da ta s to r a g e , u n l e ss th i s o p ti o n is sp e c if ic a lly d isa b le d b y th e u se r. A sa mp le f o rma t, n o n - XMP, i s p r o v i d e d b e lo w a n d o b ta in e d f r om the P D F R e fe re n ce M a n u a l ve rsio n 1 . 6 [ 2 2 ] :

1 0 o b j

< < / T i t l e ( P o s t S c r i p t L a n g u a g e R e f e r e n c e )

/ A u t h o r ( A d o b e S y s t e m s I n c o r p o r a t e d )

/ C r e a t o r ( A d o b e F r a m e m a k e r )

/ P r o d u c e r ( A c r o b a t D i s t i l l e r )

/ C r e a t i o n D a t e ( D : 1 9 9 7 0 9 1 5 1 1 0 3 4 7 - 0 8 ’ 0 0 ’ )

/ M o d D a t e ( D : 1 9 9 9 0 2 0 9 1 5 3 9 2 5 - 0 8 ’ 0 0 ’ )

e

> >

n d o b j

G iv e n th a t th e X MP sp e c if ica tio n is v e r y e x te n si v e a n d h a s a mu l ti tu d e o f o p ti o n s, t h e r ea d e r is r ef e r re d to th e sp e cif ic a t io n d o c u m e n t [ 2 6 ] f o r f u r t h er in f o r m a ti o n . Ne ed le ss to sa y, s to r in g th e me ta d at a in a ty p e o f X ML f o r ma t wi ll a id tr e me n d o u sl y in th e d o c u me n t f o r en s ic s ar e na .

8 . D ETE C TI O N TOOL S

M eta d ata d ete c t io n to o ls ar e p r ev a le n t , g i v e n th e n u mb e r p r o g r a ms th a t we r e re tu r n e d a f te r a se a r ch at G o o g le . A f e w f r ee wa re a n d sh a re w a re p r o g r a ms w er e c h o se n r a n d o m ly f r o m th e re su l ts o f my se a r c h t o p r o v i d e a d isc u ssi o n o n th e f u n c t io n a lity o f th e a va ila b le to o l s. I n a d d it io n , o n e p r o g r a m w a s o b t a in e d f r o m a g u e st sp e a k e r at a c o n f e r e n c e a s a sp e c ia l c i rc u msta n c e f o r r e se a r c h p u r p o se s.

T h e te sts c o n d u ct e d in th i s se c tio n a r e n o t sc ie n tif ic a n d d o n o t e x am in e a la rg e , d iv e r si f ie d se t o f d o c u me n ts. T h e tw e n t y d o c u m e n t s te st ed c o n siste d o f an as so r t me n t o f : M ic r o so f t Wo r d d o c u me n t s, P o we r Po i n t p r e se n ta ti o n s, an d E x c e l s p r ea d sh e e ts ( p r e - XM L a n d n e w X ML f o r ma ts) ; O p en O ff ic e . o rg Wr ite r d o c u me n t s, I mp r es s p r e se n t at io n s, a n d Ca lc sp r e a d sh e e ts; a n d PDF d o c u m e n t s.

E i g h ty - f iv e p e r ce n t o f t h e d o cu m e n ts we r e c h o se n r a n d o ml y f r o m th o s e d isc o v e r e d th r o u g h Go o g le se ar c h e s, a n d at th e o n s et o f th e te st s, we r e n o t k n o w n to co n t a in a n y me ta da ta . T h e r e ma in in g f if te e n p e r c e n t o f th e d o c u me n t s we re c h o se n f r o m th e a u th o r ’s o wn d o c u m en t lib r a r y as th e y w er e k n o w n to co n t a i n mu c h o f th e ty p e s o f me ta d at a d isc u sse d i n th i s d o c u m e n t , th e r ef o r e h ig h li g h ti n g th e c a p a b ilit ie s/limita tio n s o f th e d e tec tio n to o ls d is cu s se d in th i s se c ti o n .

8 . 1 l ib ex t ra cto r a nd e xt ra ct

T h i s o p en so u r c e c om ma n d - lin e to o l [ 2 7 ] wa s d isc o v e r e d th r o u g h o n e o f ma n y se ar c h e s f o r me ta da ta e x tr a c tio n t o o ls. L ib e x tra c t o r is th e a ct u al l ib r a r y th a t is u se d to e x t ra c t me ta da ta f r o m se v e ra l d i ff e r e n t d o c u m e n t f o r ma ts a n d t he e x tra c t to o l is th e ac t u a l p r o g r a m e x e c u te d o n th e c o mma n d - li n e to p er f o r m t h e e x tr ac t io n . Bo th th e li b r a r y a n d p r o g r a m a re a v ai la b le f o r L in u x a n d Wi n d o ws p la tf o r m s; f r ee ; a n d r e d i st r ib u t ab le u n d e r t h e G N U g e n e r a l p u b li c l ice n se .

F r o m th e li b r ar y ’s h o me p a g e [ 2 7 ] , it su p p o r ts th e f o ll o wi n g f o r ma ts : H T ML , PDF, PS, O L E 2 ( D OC, XL S, P PT ) , O p en O ff ic e ( sx w) , S ta r Off ice ( sd w ) , D V I , M AN , MP3 ( I D 3 v 1 a n d I D 3 v 2 ) , O G G , WAV, E X I V2 , JPE G, G I F, PN G , T I FF, D E B, RPM, TA R(. G Z ) , ZI P, E L F, REA L, RI FF ( AVI ) , M PE G, Q T a n d A SF. E v e n t h o u g h th is u t ility h as th e c a pa b il it y to de te c t me ta da ta i n ma n y d iff e r e n t f ile f o r ma ts, w h ic h ca n u n d o u b t e d l y p r o v e b e n e f ic ia l to th e f o r e n sic e x a min e r, th i s se c tio n wi ll o n l y e x p lo r e it s c a pa b iliti e s ag a in st th e PD F, O L E 2 , a n d O p e n O ff ic e f i le f o r ma t s.

T h e i n st al lat io n o f b o t h th e li b r a r y a n d p r o g r a m w er e

stra i g h tf o r w a r d . T h e in sta lla ti o n mac h in e wa s r u n n i n g U b u n t u L in u x w h ic h o ff e r ed the c a pa b ility to simp l y u s e th e a p t- g e t u til it y to in sta ll u tili tie s. L ik e w ise , r u n n i n g th e p r o g r a m wa s si mp le a n d y ie ld e d imm ed i a te r e su lt s.

To r u n th e p r o g r a m , o n e o n l y n ee d s to issu e t h e co mma n d f o llo w e d b y th e f i le n ame to b e e x am in e d :

$ e xt r a c t f i l e n a m e

U si n g th e to o l in th is ma n n e r w ill simp ly d isp la y the re su l ts t o th e te rm in al scr e e n in a n e a sy to r ea d f o r ma t. I t d o e s h a v e a d d iti o n a l o p ti o n s, o n e o f w h ic h is the ab i lity to ch a n g e th e la n g u a g e set tin g s ( i. e . se a r c h a Ge r ma n in ste a d o f U . S. E n g lish d o c u me n t) . A n o th e r u se f u l o p ti o n i s th e ab i lity to o u t p u t t h e r esu lts o f th e me tad a ta d isc o v e r y in BiBTe X f o r ma t in c a se t h e e x am in e r o r a u t h o r u se d th e se t y p e s o f e n t r ie s to assist in d o c u me n ta tio n .

D u r in g th e c o n d u c t o f th i s te st, o p ti o n s we re a d d e d to th e c om ma n d l in e to ca u se th e p r o g r a m t o b e v e r b o se ( - V ) a n d p r in t t h e f il en a me in th e r e su lt s ( - f ) . T h is p r o g r a m wa s a b le to o p e r a te a n d r e p o r t b a sic me ta d a ta r e su lt s o n e a c h o f t h e f il e ty p e s o u tl in e d p r e v io u sl y. T he b a sic ty p e s o f met ad a ta re p o r t e d b y t h e p r o g r am o n ea ch f ile i n clu d e th e f o ll o wi n g :

O p e ra t in g Sy st e m ( O n w h ic h the fi le wa s c re a ted )

Size

O rg a n iz a tio n

Mo d if i c a tio n Da te

Cre a tio n D at e

Pa g e Co u n t

So f tw a r e ( O n w h ic h th e f ile wa s cr ea te d )

Ve r si o n ( o f th e f ile )

Fo r ma t ( Tem p lat e u se d t o c r ea te th e f ile )

A u th o r

Ti tle

K ey w o r d s

File n a me

N o t a ll o f th e f ile s te st e d r e p o r te d a ll o f th e p r e v io u s me ta d a ta , b u t the p r o g r a m p ic k e d u p a s muc h a s e a c h f ile c o n ta i n e d , w ith re ga r d s t o th e b a sic in f o r m a tio n ab o v e . T h i s p r o g r a m d id n o t r e p o r t meta d a ta s u ch a s c omme n ts, la st te n a u th o r s, o r tr a c k c h a n g es i n f o r ma tio n , a s i t is n o t d e sig n e d to d o so . T h e u se r c an issu e t he – V o p ti o n to th e p r o g r a m to v ie w a l l th e ty p e s o f me ta d a ta o n wh i ch th e p r o g r a m c a n re p o r t r e ga r d i n g t h e ma n y d iff er e n t su p p o r te d f ile t y p e s.

T h is p r o g r a m i s o n ly d e sig n e d t o re p o r t b a sic me ta da t a in f o r ma t io n a sso c ia t ed wi th a f ile . Gi v e n it s d es ig n , it p e r f o r me d we ll a n d w o r k e d a s e x p e c te d . H o we v e r, t o d isc o v e r th e d a ta th a t ma y b e mo re i n c r im in a tin g to a u s er a n d b e n e f ic ia l t o a f o r e n si c in v e st ig a t o r, it is in a d e q u a te .

8

. 2 pd f i nf o

P d fin f o is a c o mma n d - lin e to o l p r o v id e d in th e o p e n so u r c e x p d f [ 2 8 ] pa c k ag e f o r d iff e r e n t v e r sio n s o f L i n u x a n d U NI X . T h e p u r p o se o f th e p d fi n f o p r o g r a m is to p r in t o u t me ta d a ta in f o r ma t io n th a t i s s to r e d in PDF d o c u me n ts. T h e p r o g r a m h a s a b a se f u n c ti o n a l ity th a t is in v o k e d wi th th e f o ll o wi n g c om ma n d :

$ p df i n f o f i l e n a m e

Mo r e in f o r ma tio n re g a r d in g th e sto r e d met a da ta c a n b e re t u r n e d in X ML f o r ma t b y su p p ly i n g i t wi th an a d d it io n a l o p tio n ( – m e t a) . Ac c o r d in g t o th e p d fi n f o ma n p a g e , th e p r o g r a m is d e sig n e d to re p o r t th e f o l lo w in g meta d a ta in f o r ma t io n th a t ma y b e c o n ta i n e d w ith i n a te ste d f ile :

Ti tle

S u b je c t

K e y w o r d s

A u th o r

Cr ea to r

P r o d u c e r

Cr ea tio n d a te

M o d if ic a t io n d a te

Ta g g ed ( y e s/n o )

P ag e c o u n t

E n c r y p te d fla g ( y e s/n o )

P r in t a n d co p y p e r m is si o n s ( if e nc r y p te d )

P ag e s ize

F ile siz e

L i n ea r i ze d ( y e s/n o )

P DF v e r sio n

T h e p r o g r a m w o r k e d a s d e sc r i b ed a n d a s e x p e c te d r e p o r ti n g a l l b a sic meta d a ta p r e se n t in th e d o c u me n t. H o w e v e r, th i s p r o g r a m, li k e th e ex tra c t p r o g r a m d isc u sse d p r e v io u sl y, wa s n o t ab l e to re p o r t o n e mb e d d e d c o mme n ts i n a PDF f ile . O f

th e PD F d o c u me n t s te ste d , a g o o d amo u n t o f in f o r m a tio n wa s

r e p o r t ed , n o n e o f w h ic h p r o v i d e d a tr e me n d o u s a mo u n t o f u s ef u l d at a e xc e p t f o r th e ty p e o f p r o g r a m u s ed to c re a te th e d o c u m e n t a s we ll a s d a te s c re a te d an d mo d i f ie d . T h e se d a te s c o u l d be u se f u l b y a n in v e st ig a to r to c r ea te a timeli n e o f a c tiv ity le a d in g a n i n v e stig a to r to o th e r i n f o r ma t io n o r s u p p o r ti n g h y p o th e se s.

8 . 3 M et a d at a An a ly zer

M eta d ata An a ly z e r [ 2 9 ] i s a f re e wa r e ap p l ica tio n f o r u se o n

Wi n d o ws ME /N T /2 0 0 0 / X P/ 2 0 0 3 . I t h a s o n ly o n e p u r p o se a n d th a t is to r e p o r t o n t h e meta d a ta p r e se n t in Mi cr o s o f t Wo r d d o c u me n t s, P o we r Po i n t p r e se n ta ti o n s, an d E x c e l s p r ea d sh e e ts . T h e p r o g r a m is sma ll , ea sy to in sta ll, a n d o p e r a te s as a sta n d - a lo n e p r o g r a m. W h e n la u n c h e d , th e p r o g r a m o ff e r s a u se r in t er f a ce th a t in i tia ll y de t ec ts a n d r e p o r t s th e b u i lt- in O ff ic e p r o p e r tie s: U se r Na me, U se r I n it ia ls , a n d Co mp a n y.

T h e u s er h a s th e ca pa b il ity to p o in t th e p r o g r a m to a f ile f o r

a n a ly s is o r th e u se r c a n s imp l y d r a g th e r e sp e c ti v e Wo r d , P o we r Po i n t, o r E x c e l d o c u m e n t ic o n o n t o th e p r o g r am . O n ce

th a t ac tio n is p e r f o r me d , th e u se r mu st p r e ss th e An a ly z e

b u tt o n t o b e g in me ta d a ta de tec t io n . T h e p r o g r a m o ff e r s a n

e a sy to r ea d re p o r t b u t n o c a p a b ilit y to sa v e , w h ic h i s n o t c o n d u c iv e to d o c u m en t a tio n . T h e f o ll o w in g d o cu m e n t p r o p e r tie s a re r e p o r t ed :

Ti tle

Cr ea tio n Time

L a st E d it e d

L a st Pr in t Da te

A u th o r

Co mp a n y

Re v i si o n N u mb e r

To t al E d iti n g Time

L a st Au t h o r

F u r th e r mo r e , th e p r o g r a m re p o r ts a n y c u sto m p r o p e r tie s th a t ma y a lso b e p r e se n t in th e d o c u me n t met ad at a . T h is p r o g r a m

is ea sy to u se b u t lik e th e o t h e r p r o g r a ms te ste d a n d d isc u sse d

p r e v i o u sl y, la c k s t h e ca pa b il ity to r e p o r t mo r e a d v a n ce d me ta da ta i n f o r ma tio n su c h a s e mb ed d e d co mme n ts a n d

r e v i si o n s f r o m Tr ac k Ch a n g e s.

8 . 4 e zCl ea n

e z Clea n [ 3 0 ] i s a c o mmer c ia l met ad a ta d e te cti o n a n d r em o v a l

to

o l f o r u se o n Mic r o so f t O ff ic e p r o d u c ts. T h is p r o d u c t

w

o r k s o n a ll Win d o ws o p er a ti n g s y st ems a f te r a n d in c lu d i n g

Wi n d o w s 9 5 ; h o w e v e r, th e p r o g r a m in c o r p o r a te s it se lf in t o Mic r o so f t O ff ic e a n d th e re f o r e r e q u i r es O ff ic e 2 0 0 0 o r lat e r. K KL So f tw a r e [ 3 1 ] se lls th e p r o g r a m f o r a n o mi n al f e e b u t o ff e r s a 4 5 d a y f r e e tr ia l , w h ic h wa s u se d to p e r f o r m d o c u me n t te stin g .

Pr o g r a m in s ta lla ti o n wa s e asy af te r w h ic h t h e p r o g r a m i s ac ce ssib le th r o u g h a si n g le b u tt o n o n th e Wo r d , E xc e l, o r Po we r Po in t to o lb a r. W h ile a d o cu m e n t is o p e n in th e re sp e c tiv e Off ic e p r o g r a m, t h e u se r simp ly h a s to c lic k th e b u tto n , w h ich c a u se s the so f tw a r e t o a u to ma tica lly c h e c k f o r me ta d a ta .

E v e n th o u g h th e ma jo r p u r p o se o f the p r o g r a m is to r emo v e me ta d a ta sa ve d w ith th e d o c u m e n t, it p r o v i d e s a stra i g h tf o r w a r d u se r i n te r fa ce a n d re p o r tin g to o l b e f o r e th e u se r h a s th e c h o ic e to r emo v e th e d a ta. T h e in i tia l c he ck o p e n s a n in te r fa ce th a t p r e se n t s b a sic o p ti o n s f o r v ie w in g th e me ta d a ta ; h o we v er, th e re p o r t f u n c t io n cr ea te s a we b p a g e th a t p r o v i d e s c o mp le te ac cess to t h e d e te c te d in f o r m a tio n .

T h e e x i ste n c e o f meta d a ta is r e p o r te d in se ve ra l d i ff e r e n t sect io n s. A sa mp le o f th e t y p e o f me ta d at a r e p o r te d u n d e r t he re sp e c tiv e se c ti o n i s li st e d b e l o w:

Bu ilt- in D o c u me n t Pr o p e r ti e s

Title

A u th o r

Su b jec t

Co mp a n y

D o c u me n t Sta t istic s

Cr ea te d ( Da te )

Mo d if ie d ( Da te )

[ 3 2 ] .

I n a d d iti o n , th e p r o g r am wa s r o b u s t a t n o t o n ly re p o r t in g t h a t th e Tra c k Cha n g e s fe a tu r e wa s o n o r o ff , b u t mo r e im p o r ta n tly, it r ep o r t e d a ll o f t h e in f o r ma t io n p r e se n t w ith r e sp ec t to a l l th e c h a n g e s t h at we re ma de as we ll a s th e u se r id o f th e r e v isio n e r, t he ty p e o f a ct io n ta k e n , a n d th e te x t c h a n g ed , de le te d , o r a d d e d to th e d o cu m e n t .

8 . 5 D o cu me nt Det ect iv e

D o cu me n t De tec tiv e [ 3 3 ] is a c omme r cia l p r o d u c t d e si g n ed b y SRS Tec h n o lo g ie s a n d i s c ate r e d t o g o v e r n me n t u se . A tr i al v e r sio n f o r re sea r c h p u r p o se s wa s o b ta in e d a ft er a t te n d i n g a c o n f e re n c e p r e se n ta tio n b y i ts a u th o r. I t is a Wi n d o ws ba se d p r o g r a m th a t is d e sig n e d to wo r k o n M ic r o so f t Win d o w s 2 0 0 0 a n d XP. I t a lso re q u ir e s th a t th e u s er h av e M ic r o so f t O ff ic e X P o r 2 0 0 3 in sta lle d o n th e p r o g r a m u se d f o r te sti n g . Ac co r d i n g to th e p r o g r a m ’s d o c u m e n t ati o n [ 3 4 ] , it w o r k s o n : Wo r d d o cu m e n ts; E x c e l s p r ea d sh e e ts ; Po w e r Po i n t p r e se n ta ti o n s; Ric h Te x t Fil es ; H TM L f ile s; we b a rc h iv e s ( MH T & MHT ML ) ; X ML f ile s; te x t f ile s; a n d PD F d o c u m e n ts.

A s me n tio n e d b e f o r e , a n e v a lu a ti o n co p y h a d to b e s p ec i f ic a lly r e q u e ste d f r o m th e p r o g r a m’s a u t h o r, so it wa s n o t a s eas il y o b ta in a b le a s th e o th e r p r o g r am s te st ed . T h e in sta lla ti o n o f th e p r o g r a m wa s str ai g h tf o r w a r d , a f ter w h ic h th e p r o g r a m c a n e ith e r b e la u n c h e d f r o m wi th i n Wo r d , P o we r Po i n t, a n d E x ce l , o r as a se pa r a te p r o g r a m. A ll d o c u m e n t s we r e te ste d a g a in st t h is p r o g r a m, w h ic h p r o v i d e d a w e alt h o f i n f o r ma tio n r e ga r d in g th e meta da ta co n t a in e d w ith i n e ac h o f th e d o c u me n ts.

Pr in te d ( Da te )

T h i s p r o g r am is n o t o n l y d e sig n e d t o d e te ct me ta da ta b u t

L a st sa v e d b y

sc r u b d o c u me n ts f o r d e fi n e d k ey w o r d s. A s su c h , t h e f ir st

Re v isio n n u mb e r

sc r ee n t h a t is p r e se n te d a llo w s th e u se r to se lec t f r o m a

Cu sto m Pr o p e r ti e s

p r e d e f in e d li st o f ke y wo r d ca te g o r ie s, su c h a s “ Co r p o r a te

_ E ma ilSu b j e c t

Re le a sa b le I n f o r ma ti o n ,” tha t w ill th e n al lo w th e u se r to

ai

_ A

u t h o r E

m

l

d e t er mi n e w h a t se t o f k e y w o r d s h e /sh e w o u l d lik e th e

ai

_ A

u t h o r E

m

lD isp la y N am e

p r o g r a m to fla g if p r e sen t . A f te r se lec ti o n , th e p r o g r a m sc a n s

Mac r o s

th e d o c u m e n t a n d p r e se n ts all th e me tad a ta in f o r m ati o n a n d

A tta ch e d Tem p la te

k e y w o r d s f o u n d . T he d isc o v e r e d d ata is p r e se n te d in a se r ie s

Co mm en t s

o f ca te g o r ie s.

Em b e d d e d O L E O b je c ts

A u th o r a n d Fi le n a me H ist o r y

U n d o H isto r y

Fa st Sa v e s

Tr a c k Ch a n g e s Fe atu r e ( O N /O FF)

D o c u me n t Re v i si o n s ( f r o m Tra c k Ch a n g e s)

A u th o r ( Use ri d )

Ty p e (i .e . I n se r te d )

Te st ( i.e . “a d d ed te x t” )

T h e Cu s to m Pr o p e r ti e s se c ti o n liste d a b o v e wa s d iff e r e n t a n d sp ec i f ic f o r ea c h o f t h e d o c u me n ts c o n ta in in g th i s ty p e o f in f o r ma t io n . H o w e v e r, it w as a v a l u a b le p ie ce o f in f o r m a tio n as it w as e as y to se e w h o o r i g in a ll y au t h o r e d th e d o c u me n t a n d w h o se n t i t o u t th r o u g h e- ma il a t o n e time o r a n o th e r.

Fo r in sta n c e , d u r in g th e te st o f th e d o cu m e n t th a t re t u r n e d th e a b o v e c u sto m p r o p er t ie s, it wa s d isc o v e r e d th a t t h e d o cu m e n t a u th o r wa s d iff e r e n t t ha n th e p e r so n th a t e - ma ile d t h e d o c u me n t . Wh i le th is ma y n o t b e a maj o r d i sc o v e r y in ma n y ca se s, a f o r en s ic in v e st ig a to r co u l d p e r f o r m a l in k a na ly sis a n d at temp t to f o ll o w th e p e r so n n e l wi th a cc e ss to t he d o c u me n t . I n a n o t h e r d o c u m e n t, w h ic h in f ac t w a s a 2 0 0 5 f ir st q u a r t e r f in a n c ia l r ep o r t f r o m a ma jo r w ire le ss p h o n e c om p a n y o b ta in ed f r o m G o o g le , th e p e r so n w h o e- m aile d th e d o c u me n t a s we ll as th e w eb - ba se d a p p l ic a tio n th a t w a s u se d to c re a te th e r e p o r t w as d isc o v e r e d f r om t h e c u sto m p r o p e r tie s

A sa mp le o f th e met ad a ta ca te g o r ie s a n d su b - c a te g o r ie s p r e se n t ed f o ll o ws:

D o cu me n t

Pa th

File n ame

Bu il t in D o c u me n t Pr o p e r tie s

Title

Su b jec t

A u th o r

Ke y wo r d s

Co mme n ts

Tem p la te

L a st A u th o r

Cr ea ti o n Da te

L a st Sa v e Time

Co mp a n y

Co mme n ts

Da te

A u th o r

Ra n g e Te x t

Re fe r e nc e Te x t

Sc o p e Te x t

Sh o w Ti p

I n it ia l

Re v i si o n s

Da te

Fo r ma t D e sc r ip ti o n

Ra n g e Te x t

Ty p e

A u th o r

T h is p r o g r a m wa s b y f a r t he mo st th o r o u g h p r o g r a m a t

re

p o r t in g meta d a ta i n f o r ma t io n te st ed to th i s p o i n t. I t

re

p o r t e d f ar mo r e de tai le d in f o r ma tio n th a n th e

af o r e me n t io n e d p r o g r a ms; h o w e v e r, th e in te r f ac e wa s mu c h

mo re d i ff ic u lt to n a v i g a te th a n a ll th e o th e r to o l s in o r d e r to

v ie w th e d e si re d in f o r m a ti o n . T h i s is th e f ir st v e r sio n o f th i s

p r o g r a m s o it is e x p ec te d t h a t it w ill u n d er g o s o me ma jo r im p r o v e m en ts as t ime g o e s o n .

O n e o f th e b e n e f i ts o f th i s p r o g r a m is th a t it w o r k e d o n t h e

f u ll ra n g e o f Mic r o so f t O ff ic e p r o d u c ts, to in c lu d e th e ne w

O ff ic e X ML f o r ma t, an d P DF d o c u m e n ts. Ho w ev e r, it w as

n o t a b l e to wo r k o n th e O p e n O ff ic e . o rg r a n g e o f f ile s e v e n

th o u g h th e y a re b y d e fa u l t sa v e d in a n X ML f o r ma t.

T h i s p r o g r a m w as th e mo st n o ta b le in t h e r a n g e o f

in f o r m a t io n r e p o r te d as w e ll a s th e w a y s th a t t h e p r o g r a m

c o u l d be u se d . Fo r in sta n c e, a f te r r u n n i n g th e p r o g r a m

a g a in s t a ll o f t h e te st d o c u me n t s a n d o b ta in i n g th e e x p ec te d

in f o r m a t io n , t he jm u .e d u d o ma in wa s sca n n e d f o r Wo r d

d o c u m e n t s. T RACE ! h a s a b u il t- in ca pa b ili ty to sc a n e n ti re d o ma in s, b y si mp ly c h o o sin g th a t o p ti o n f r om t he mai n u se r

in t e r fa c e . T h e sca n o n th e jmu . e d u d o ma in t o o k a l o n g t ime ,

sc an n e d o v e r 5 0 0 d isc o v e r e d d o c u m e n ts , a n d re p o r t e d the r isk

le v el o f ma n y o f th o se d o c u me n t s.

F r o m th e d o c u me n t s sc a n n e d in th e te st se t as we ll as th e d o ma in , TRA CE! r e p o r te d its re su lt s in a n ea sy to r ea d a n d

sa v e f o r ma t. Ea c h d o c u me n t wa s b r o k e n d o w n i n to th e r i sk

c a te g o r ie s li ste d ab o v e w ith th e r e spe c ti v e in f o r m a tio n t h at

le d t o t he a sse ssed r isk c at eg o r y. T h e in f o r m a tio n wa s

p r e se n t ed in H T ML f o rma t w h ic h a llo w e d f o r e x c e lle n t d o c u m e n t ati o n an d h ig h li g h te d al l in f o r m a ti o n t h at s h o u ld h a v e b e e n r ep o r t e d .

D u r in g th e te st t h at wa s c o n d u ct e d a g a in st th e jmu . e d u

d o ma in , I wa s a b le to d isc o v e r o n e sp ec if ic d o c u me n t th a t

8

. 6 TR ACE! b y Wo rk sh a re

r e p o r t ed th e la st te n a u t h o r s, wh i c h in c lu d e d th e ir u se r id . I n

T

RA CE ! [ 3 5 ] p r o v e d to b e o n e o f th e mo r e r o b u st to o ls. I t is

a d d i ti o n , th e ne tw o r k p a th wa s re p o r t e d o n w h ic h t h e

f re e so f tw a r e p r o v i d e d to sc an Mi c r o so f t Off ic e d o c u me n ts

( Wo r d , P o we r Po i n t, a n d E x c e l) an d r u n s o n E n g lish v e r sio n s

o f Mi cr o s o f t Wi n d o ws 2 0 0 0 an d XP. T h e p u r p o se o f th e

p r o g r a m is to sc a n d o c u m e n t s f o r me ta d a ta a n d e x te n siv e l y

re p o r t its f in d i n g s.

T RA CE ! o ff e r s th e u se r se v e r a l d iff e r en t met h o d s to sc an

su p p o r te d f il es su c h a s: sc a n n in g th e a c tive d o c u me n t

c u r re n tl y b e in g e d i te d ; se le ct in g a f ile o r se v e r a l f il es lo c a te d

o

n th e h a r d d r iv e ; sc a n n in g e - ma i l a tta c hme n ts l o ca te d in th e

u

se r ’s Mic r o so f t O u tlo o k lo ca l ma il f o ld e r ( s) ; a n d s p ec i f y in g

a

URL , w h ic h w il l c au se the p r o g r a m to se a r c h a sp e c if ie d

d

o ma in f o r Wo r d , E x c e l, a n d Po w e r Po in t f ile s an d e v a lu a te

th e met a d ata in th e d isc o v e r e d d o c u m en t s.

T RA CE ! mo n i to r s a n d re p o r t s r i sk le v els o f t h e d o c u m e n t,

sp r ea d sh e e t o r p r e se n ta tio n . T h e r isk le v e ls u se d b y th is

p r o g r a m a r e h ig h , me d iu m, a n d l o w. A d et e rmi n at io n o f t h e

le v el o f r isk p o se d b y th e d o c u me n t d e p e n d s o n th e t y p e s o f

me ta d a ta p re se n t in th e d o c u me n t . T h e d e ta ils o f w h a t q u a lif i e s a s h ig h , me d iu m, a n d lo w r isk a r e f o u n d in t h e u se r ’s g u i d e [ 3 6 ] a n d th o s e e le me n t s d e a lin g d ire c tl y w ith met ad a ta

ar e i n clu d e d b e lo w :

H ig h Risk :

I d e n tit y I n f o r ma tio n

Tr a c k Ch a n g e s

Co mm en t s

H id d e n Te x t

Sp e a k e r N o te s ( Po we r Po in t)

Ve r si o n s

La st Ten A u th o r s w it h U N C Pat h s

H id d e n Slid e s ( Po we r Po i n t)

A u to ma ti c Wo r d Ve r si o n in g

Me d iu m Risk :

Cu sto m Pr o p e r ti e s

Mac r o s

D o c u me n t Re v i ew s

L o w Risk :

La st Ten A u th o r s w /o U NC p at h s

D o c u me n t Sta t istic s

Bu ilt I n P r o p er t ie s

A tta ch e d Tem p la te

d

( \\ DATA7 \ OSP \CO M MO N \0 0 n w sltr ) . With th i s i n f o r ma t io n ,

th e in v e stig a to r n o w h a s th e ne t wo r k d i r ec t o r y t h at t he u se r id

h a s p r iv ile g e s o n w h ic h t o sa v e . T he _ P I D_ G U I D asso c ia te d

w ith th i s d o c u m e n t w as a lso r e p o r te d , w h ic h c o u ld le a d to d isc o v e r y o f th e e x ac t mac h ine o n w h ic h th e s p ec if ic u se r c re a te d th e d o c u m e n t.

sa v e d

o c u m e n t

wa s

la st

8

. 7 To o l a nd Te st Res ul t s

O

v er a l l, th e p r o g r a m s te ste d p r o v i d e d a t lea st th e b a sic

me ta da ta p r e se n t in ea c h d o c u me n t. T h e L i n u x t o o ls te ste d , a s we ll as Me ta da ta A n aly z e r, we r e b y fa r t h e le a st c ap a b le o f

th e g r o u p o f to o l s. T h e y p r o v i d e d min ima l in f o r m ati o n a n d

o n l y o n e, li b ex tra c to r , wa s a b le t o w o r k o n mo r e t h an o n e se t

o f d o c u me n t ty p e s.

e z Clea n , D o c u men t D e te c tiv e , a n d T RA CE ! p r o v i d e d a

w e alt h o f i n f o r ma t io n a b o u t th e me ta d a ta t h ey we r e d e sig n e d to d e te c t an d re p o r t, wh i c h ma ke s th e m mo r e u se f u l i n f o r e n sic sc e n ar i o s. e z Cle a n in c o r p o r a te d itse lf in the

M ic r o so f t O ff ic e p r o g r a ms a n d wa s v e r y ea sy to u se.

D o cu me n t De te c ti v e wa s a li ttle mo r e d i ff ic u lt b ec a u se it

in sta ll s itse lf a s a ma c r o in s id e o f Micr o s o f t O ff ic e p r o g r a ms.

I f th e u se r h a s th e mac r o se c u r ity le v el set t o h ig h , th e p r o g r a m w il l n o t r u n ; if se t to me d iu m, th e u se r h a s to p r e ss

se v e ra l b u tt o n s to al lo w t h e p r o g r a m to r u n . Ho w e v e r, th e

a b i li ty o f D o c u me n t D e te c tiv e to w o r k o n a w id e r r a n g e o f d o c u m e n t s ma ke s it mo r e u s ef u l in a d y n am ic f o re n sic e n v i r o n me n t.

T RA CE ! is th e b e st p r o g r a m w ith r e ga r d s to u s ab i lit y an d

in t e r fa c e , b u t wa s limite d b y th e amo u n t o f d o c u me n t s o n

w h ic h it wa s d e sig n e d to w o r k . I ts u s er in te r f ac e, de t ec ti o n

a n d re p o r t in g ca pa b iliti e s we r e r ic h e r t h an th e o t h er p r o g r a ms

te ste d . I f a n in v e st ig a t o r is o n l y r e q u ir e d to e x am ine

M ic r o so f t O ff ic e d o cu m e n ts, T RA CE ! sh o u l d b e c o n si d er e d

f o r a d d itio n in th e f o r e n si c an a l y si s to o l k it .

A lth o u g h o n l y b r ie f ly to u c h e d u p o n d u r in g t h e d is cu s si o n o f

th

e v a r io u s to o l s, muc h i n f o r ma t io n w as d i sc o v er e d d u r i n g

th

e c o n d u c t o f th e in v e st ig a tio n . User n a me s we re d isc o v e r e d

in

se v e ra l d o c u m e n ts th a t c a n b e u se d to a sce rta in h o w a u se r

lo

g s o n t o a n e tw o r k a n d p r o v e d ev e n mo r e v a lu a b l e w h e n

n e t wo r k sto r a g e p a th s w e r e d isc o v e r e d . T h e c omb in a tio n o f

u s er n a me s a n d sto r a g e p at h s al lo w s th e i n v es tig a to r to g e t a

b r ie f in sig h t in t o h o w u se r lo g i n s ar e a ssig n e d a n d t h e asso c ia te d n e t wo r k la y o u t.

I n a d d it io n , t h e d o c u m en ts h a v in g d o c u m e n t re v isio n s p r e se n t th r o u g h th e u se o f Tra c k Ch a n g e s, a s we ll as c o mme n t s, al lo w e d th e d i sc o v e r y o f h o w ma n y d iff e r e n t pe o p le v ie w ed a n d c h a n g e d th e d o c u m en t . D isc o v e r ie s su c h a s th i s p r o v e d u se f u l in e xa m in a tio n o f th e D o d g y D o ssie r a n d wi ll c o n t in u e to p r o v e v al u a b le in f u tu r e e xa min a ti o n s.

9 . CO NC LU SI O N

Me ta d at a is d a t a th a t d e sc r ib e s o t h e r d a ta . A s ex a min e d in th is p a p e r, me ta da ta c an lea d to th e d isc o v e r y o f a p le th o r a o f in f o r ma t io n . E x a min a tio n o f d o c u m en t me ta d ata c an lea d to th e d isc o v e r y o f i n f o r ma t io n su c h a s: d o c u me n t a u th o r n a me s; n am es o f c o n t r ib u t o r s a s w e ll as th e ir r ec o mme n d e d c h a n g e s a n d c o mme n ts; n e tw o r k sto r a g e p a t h l o ca tio n s; u se r id s o f th e d o c u me n t a u th o r ; as we ll a s co mp u t er sp e ci f ic in f o r m at io n su c h a s t h e GU I D .

Se v e ra l d iff e r e n t r ea l - wo r l d sc e n a r i o s we r e p r e se n te d d em o n st r a t in g h o w me ta d a ta w a s e x p lo ite d to r e v ea l h i d d e n in f o r ma t io n . I n so me c a se s, it w a s ad mi tt e d as e v i d e n ce to re f u t e o r su p p o r t c la ims. I n o th e r s, it r esu lte d in a n em b ar r a ssi n g si tua tio n f o r c o mp a n ie s a n d g o v e r n me n ts a li k e .

T h is p a p e r d i sc u ss ed th e ty p e s o f me ta da ta i n f o r ma tio n sto r e d in d o c u m e n ts, sp r e a d sh e e ts, a n d p re se n ta ti o n s cr e a te d i n Mic r o so f t O ff ic e a n d O p e n O ff ic e . o rg a p p li ca tio n s , PDF d o c u me n t , a n d p r o v i d e d e x am p le s o f th e ir r e sp ec tive sto r a g e f o r ma ts. As sh o w n in t h is p a p e r, a mo v e to w a r d s X ML f i le f o r ma ts h a s p r o v i d e d i n v es ti g a to r s ea sie r a c c ess to th i s ty p e o f in f o r ma t io n .

Fin a lly, th is p a p e r te ste d a n d p r ese n te d re su l ts o f se v e ra l to o l s a va il a b le to d e tec t a n d d o c u me n t th e p r e se n ce o f meta da ta . Lib e x tra c t o r, p d f in f o , a n d M eta d ata A n a ly z e r p r o v id e limi te d f u n c tio n a li ty, w h ile e zCle an , Do c u me n t De te c tiv e , a n d T RA CE ! d em o n st r a t ed g r ea t er d e te c tio n a n d r ep o r t in g ca p ab i lit ie s. Ma n y o f t h e to o ls te ste d ar e a lo n e n o t su ff ic ie n t f o r a n in v e st ig a t o r ; h o w e v e r, a c o mb in a t io n o f th o se me n ti o n e d ca n r ep o r t t he p r e se n ce o f a ll th e d i ff e r e n t ty p e s o f me ta d a ta p r e se n t in th e d o c u m e n ts ad d r e sse d d u r in g th i s p a p e r.

Me ta d at a is u se f u l i n f o r ma t io n th a t c a n b e n e f it u s er s a s th e tre n d t o p a r tic ip a te in v i r tu a l c o lla b o r a tio n g r o ws. U n d e r sta n d in g me ta d at a an d th e imp le me n tat io n o f p r o a c tiv e c o n tr o l me asu r e s a re esse n tia l to p r e v e n t th e le a k a g e o f sen s iti v e in f o r m a ti o n . U n til u se r s b e c o me mo re co n s ci o u s o f th e h id d e n in f o r m a ti o n c o n t a in e d in a n d d isse min a te d w ith th e ir d o c u m e n ts , f o r e n sic in v e sti g at o r s c a n a n d w ill e x p lo it d o c u me n t meta d ata d u r i n g th e c o n d u c t o f a n i n v e stig a ti o n .

1 0 . REFEREN C E S

[ 1 ] U. S. De p a r tme n t o f Ju st ice , F o re n sic E x a m in a ti o n o f D ig ita l E v id e n c e : A G u id e fo r La w E n fo rc eme n t. N I J Sp e c ia l Re p o r t . A p r il 2 0 0 4 . Re tr ie v e d 1 Ma rc h 2 0 0 6 f r o m h ttp :/ /w ww. n c jr s. o rg /p d ff il e s1 /n i j/ 1 9 9 4 0 8 . p d f .

[ 2 ] H o we ll, B. “ Di g ita l Fo r e n sic s: Sle u th i n g o n H ar d D r iv e s a n d Ne tw o r k s, ” T h e Ve rm o n t Ba r Jo u r n a l . Fa l l 2 0 0 5 .

f r o m

Re t r ie v e d

h ttp :/ /w ww. st r o z llc . c om /d o c s/p d f /BH o we ll_ D i g ita lFo r e n si c s. p d f .

[ 3 ] Ba ll , C. “ Ma k e Fr i e n d s w it h Me ta d a ta , ” L e g a lTe c h n o l o g y.

2 6 Ja n u a r y 2 0 0 6 . Re tr ie v e d 1 Ma rc h 2 0 0 6 f r o m

h ttp :/ /w ww. law. co m/ js p /l tn / p

2

Ma r c h

2 0 0 6

u b A r tic le LT N . jsp ? id = 11 3 8 1 8 3 5

1

[ 4 ] Ze l le r, T. J r. “ Be w ar e Yo u r Tra i l o f D ig it al Fin g e r p r i n ts, ”

0 6 4 0 .

N e w Yo r k Time s O n lin e , 7 No v e mb e r 2 0 0 5 . Re t r ie v e d 2 8

F eb r u a r y h tt p :/ /w ww. n y time s.c o m/

g e w a n t ed = 1 &e i= 5 0 9 0 &

6 0 0 &p a r tn e r = r ssu se r la n d &e mc = rss.

[ 5 ] By e r s, S. “ I n f o r ma ti o n L ea ka g e Ca u se d b y H id d e n D a ta in P u b lish e d D o c u me n ts,” IE E E Se c u r ity a n d Pr iv ac y Ma ga z i n e. M ar c h / Ap r i l 2 0 0 4 .

[ 6 ] “ Da n g e r s o f D o c u me n t Me ta d a ta, ” Re tr i e v e d 2 6 Fe b r u a r y

2

h

d o c m eta d ata _ o v e r v ie w.h t m.

[ 7 ] Ke r n a n , D . H id d e n D a ta in Ele c tro n ic Do c u me n ts . GI A C G SE C Pr ac tic a l, 5 Ju ly 2 0 0 4 . Retr i ev e d 2 2 Fe b r u a r y 2 0 0 6 f r o m h tt p :/ /w ww. sa n s. o rg /r r /w h ite p a p e r s/p r i v ac y /1 4 5 5 . p h p .

[ 8 ] Mi c r o so f t Kn o w le d g eb a se A r tic le 2 2 2 1 8 0 , “H o w an d wh y

u n i q u e i d e n ti f ie r s ar e cr ea te d in O ff ic e d o c u m e n ts, ” Re v i si o n

1 . 0 , 5 A u g u st 2 0 0 4 . Re tr ie ve d 3 0 Ma r c h 2 0 0 6 f r om

h tt p :/ /s u p p

[ 9 ] Lea c h , P. , Me a ll in g , M. a n d Sa lz , R. R e q u es t fo r Co m me n ts ( R F C) 4 1 2 2 : A U n ive rsa lly U n iq u e I d en t ifi er ( U UI D ) U R N Na m es p a ce , Ju ly 2 0 0 5 . Re t r ie v e d 1 5 Ma y 2 0 0 6 f r o m h tt p :/ /w ww. ie t f .o rg /r f c /r f c 4 1 2 2 . tx t .

[ 1 0 ] Re ite r, L . a n d Lo u d e r b ac k , J. “ Me lissa tr a il le a d s t o ‘ e x ’ v ir u s w r ite r, ” Z D Ne t On l in e . 2 9 Ma r c h 1 9 9 9 . Re t r ie v e d 3 0 M ar c h 2 0 0 6 f r o m h tt p ://n e w s. z d n e t. c o m/2 1 0 0 - 9 5 9 5 _ 2 2 -

5

[ 11 ] E wa lt, D . “ W h e n Wo r d s Co me Ba c k f r o m th e De a d ,” 1 3 D e ce mbe r 2 0 0 5 . Re tr ie v e d 2 3 Fe b r u a r y 2 0 0 6 f r o m h tt p :/ /w ww. f o r b es .c o m/2 0 0 5 / 1 2 /1 3 /mi c r o so f t- wo r d - me rc k _ c x _ d e _ 1 2 1 4 w o r d .h t ml? p a r t n e r= y a h o o ti x .

[ 1 2 ] Bo n e , J. an d Bla n f o r d , N . “ U N o ff i c e d o c t o r ed r e p o r t o n mu r d e r o f H air i ,” Time s O n lin e . 2 2 Oc to b e r 2 0 0 5 . Re tr ie v e d

f r o m

h

[ 1 3 ] Ka r p , D. “ Re v e ali n g Co d e s, ” P C Ma g az i n e . 8 Ju n e 2 0 0 4 .

Re t r ie v e d

h tt p :/ /w ww. p cma g .c o m/a r tic le

[ 1 4 ] L o n e y, M. “ ' Do d g y - d o ssi e r sy n d r o me ' r ife in t h e

w o r k p la c e , ” Z D Ne t U K . 1 4 No v e mb e r 2 0 0 3 . Re tr ie v e d 2 8

f r o m

h tt p :/ /n e w s.z d n e t. c o . u k / b u s in e ss/m an a g e me n t /0 , 3 9 0 2 0 6 5 4 , 3 9

11 7 9 0 5 , 0 0 . h t m.

[ 1 5 ] L e mo s, R. “ Me lissa cr ea t o r ma y b e u n c o v e r e d , ” Z D Ne t O n lin e . 2 9 Ma rc h 1 9 9 9 . Re t r ie v e d 3 0 Ma rc h 2 0 0 6 f r o m h tt p :/ /n e w s.z d n e t. c o m/2 1 0 0 - 9 5 9 5 _ 2 2 - 5 1 4 1 7 0 . h tml.

[ 1 6 ] Bez r o u k o v, N . “ Me lissa wo r m /v i r u s – a w o r m p ar a si tin g o n MS O ff ic e 9 7 ar c h ite ctu r a l p r o b le ms a n d M S Wo r d u se rs ’ ig n o r a n c e ,” Re tr ie v e d 3 0 Ma rc h 2 0 0 6 f r o m h tt p :/ /w ww. so f t p a n o r a ma . o rg /A n ti v ir u s/AV _ Se c r e ts /V g all er y / me lissa . sh tml.

F eb r u a r y

f r o m

2

f r o m

tt p :/ /w ww. me ta d a ta r isk .o rg / d o c u m e n t_ se c u r it y /d a n g e r s_ o f _

2

f r o m

0 0 6

2 0 0 5 / 11 /0 7 / b u sin e ss/0 7 li n k . h tml ? p a

e

n = 9 8 e 8 a f 6 7 9 a 0 7 9 7 f 4 & e x = 1 2 8 9 0 1 9

0 0 6

o r t .m ic r o so f t .c o m/ k b /2 2 2 1 8 0 / .

1 4 1 7 5 . h tml .

8

Fe b r u a r y

2 0 0 6

tt p :/ /w ww. tim es o n li n e . c o . u k /a r tic le / 0 ,, 2 5 1 - 1 8 3 7 8 4 8 , 0 0 . h tml .

2 8

Fe b r u a r y

2 0 0 6

2 /0 , 1 7 5 9 , 1 5 8 5 4 11 , 0 0 .a sp .

2 0 0 6

[ 1 7 ] Mi cr o s o f t Kn o w le d g e b a se A r tic le 2 2 3 3 9 6 , “ H o w to mi n imi ze me ta da t a in O ff ic e d o c u me n ts, ” Re v isio n 3 .2 , 2 8 Ja n u a r y 2 0 0 5 . Ret r ie ve d 2 0 F eb r u a r y 2 0 0 6 f r o m h tt p :/ /s u p p o r t .m ic r o so f t .c o m/ k b /2 2 3 3 9 6 .

[ 1 8 ] Mi cr o s o f t Kn o w le d g e b a se A r tic le 2 9 0 9 4 5 , “ H o w to mi n imi ze met a da ta in Wo r d 2 0 0 2 , ” Re v isio n 2 .6 , 6 Jan u a r y

2

f r o m

h tt p :/ /s u p p o r t .m ic r o so f t .c o m/ k b /2 9 0 9 4 5 / .

0 0 6 .

Ret r ie ve d

3 0

Ma r c h

2 0 0 6

[ 1 9 ] Mi cr o s o f t Kn o w le d g eb a se A r tic le 2 2 3 7 8 9 , “ H o w to

[ 2 6 ] Ad o b e Sy ste m s I n c o r p o r a te d , XM P S p e c ific a t io n , 2 0 0 4 .

mi n im ize me ta da ta in Mi c r o so f t E x c e l Wo r k b o o k s, ” Re v isio n

5

. 0 , 11 Fe b r u a r y 2 0 0 5 . Re t r ie v e d 3 0 M ar c h 2 0 0 6 f r o m

h

ttp :/ /su p p o r t. mic r o so f t .c o m/ k b /2 2 3

7 8 9 /E N - U

S/.

[ 2 0 ] Mi cr o s o f t Kn o w le d g eb a se A r tic le 3 1 4 8 8 0 , “ H o w to

mi n im ize t h e am o u n t o f meta d a ta in Po w e r Po i n t 2 0 0 2

p r e se n t at io n s,” Re v isio n 1 .0 , 1 0 S ep te mb e r 2 0 0 4 . Re t r ie v e d

f r o m

3

h ttp :/ /su p p o r t. mic r o so f t .c

[ 2 1 ] Su n Mic r o sy ste m s, O p en O ffi ce .o rg X ML F ile Fo r ma t

1 . 0 Te ch n i c a l Re fe re n c e M a n u a l , Ve r sio n 2 , De c embe r 2 0 0 2 .

Re t r ie v e d

f r o m

h ttp :/ /x m l. o p e n o ff i c e . o rg /x ml _ s p e c if ica tio n . p d f .

[ 2 2 ] Ad o b e Sy ste ms I n co r p o r a te d , P D F Re fe re nc e - A d o b e

P o rta b le Do c u me n t F o rma t , 5 th ed , Ve r sio n 1 . 6 , 1 4 N o v e m b er

0

Ma rc h

2 0

2 0 0 6

o

m/ k b /3 1 4 8 0 0 /E N - U S/.

Fe b r u a r y

2 0 0 6

2

0 0

4 .

Retr i e ve

d

3 0

Ma r c h

2 0 0 6

f r o m

h

ttp :/ /p a r tn e r s. a d o b e .c o m/p u b li c /d e v el o p er / e n /p d f / PDFRe f e r e

n

ce

1 6 . p d f .

[ 2 3 ] Ad o b e Sy ste ms I n co r p o r a te d , “ E x te n sib l e Me ta d a ta Pla tf o r m ( XMP) h o me p a g e ,” Retr i ev e d 3 0 Ma r c h 2 0 0 6 f r o m

h

ttp :/

/w

ww.

a d o b e .c o m/p r o

d u c t s/ x mp / ma i n .h t ml .

[ 2 4 ]

T h e

Pr o g r a mme r ’s File

Fo r m a t Co ll ec tio n .

h

ttp :/

/w

ww.

wo t si t.

o rg /

[ 2 5 ] Mi cr o s o f t Do w n lo a d Ce n te r, “ Wo r d 2 0 0 3 : Ric h Te x t

Fo r ma t ( RT F) Sp ec if ic a tio n , Ve r sio n 1 . 8 ,” 2 0 A p r il 2 0 0 4 .

Re t r ie v e d

d s/ d et a il s. a sp x ? Fa mily I D

=a c 5 7 d e 3 2 - 1 7 f 0 - 4 b 4 6 - 9 e 4 e - 4 6 7 e f 9 b c 5 5 4 0 & d isp l a y la n g = e n .

f r o m

h ttp :/ /w ww. mic r o so f t .c o m/ d o w n lo a

3 0

Ma r c h

2 0 0 6

f r o m

h tt p :/ /w ww. ad o b e . c

[ 2 7 ] lib e x t r ac t o r - A Simp l e L ib r a r y f o r Ke y wo r d E x t r a ct io n .

Re t r ie v e d

3 0

M ar c h

2 0 0 6

o m/p r o d u c ts/x mp / p d f s/ x mp s p e c . p d f .

h

tt p :/

/g n u n et . o rg /l

ib e x tr a c to r / .

 

[ 2 8 ]

 

Xp d f :

A

PD F

Vie we r

f o r

L in u

x .

h

tt p :/

/w

ww. f o o la b s.

c o m/x p d f / h o m e . h tml .

 

[ 2 9 ]

 

Meta d a ta

A n a ly z e r.

h

tt p :/

/w

ww.

sma r tp c

to o l s.

co m /me ta da ta /.

[ 3 0 ]

 

ez Cle a n

 

H o me

Pa

g e .

h

tt p :/

/w

ww.

k k lso f tw a r e .c

om/p r o d u c ts/e z Cle

an /d e ta ils. a sp .

[ 3 1 ]

 

KK L

So f t wa r e

Ho m e

Pa

g e .

h

tt p :/

/w

ww. k k lso f tw a r e .c

om/i n d e x . a sp .

 

[ 3 2 ]

ir.n e t/med i a _ f il es /ir o l /9 5 / 9 5

D o c u me n t

lo c a ted

at

h ttp :/ /me d ia .c o r p o r a te -

5 3 9 /r e p o r ts/c in g u l a r _ p r o f o r ma .x l

s

[ 3 3 ]

 

D o c

u me n t

De tec tiv e

H o me

P ag e .

h

tt p :/

/w

ww. st

g .sr s. c o m

/e

d s/

d o c d e t/.

[ 3 4 ]

Do c

u me n t

 

De

tec tiv e

Ca p a b ilitie s

Pa g e .

h

tt p :/

/w

ww.

st

g .sr s. c o m

/e

d s/

d o c d e t/c ap a b i li tie s. h tm .

[ 3 5 ]

 

T RA CE

!

b y

Wo r k s h ar

e .

h

tt p :/

/w

ww.

wo r k s h a r e .c

o m/p r o d u c t s/ tr a c e/.

 

[ 3 6 ]

T RA CE !

b y

 

Wo r k s h ar e :

User ’s

Gu i d e .

h

tt p :/

/w ww. wo r k s h a r e .c

o m/d o w n l o a d s/ p r o d u c t s/ tr a c e / b u il d _ 8

2

5

6 /T RA CE ! % 2 0 b y % 2

0 Wo r k sh a r e % 2 0 Qu i c k %

 

2

0 Re f e r en c e % 2 0 G u i d e% 2 0 2 . 0 . p d f .