A Word document, a photograph taken with a cell phone, a PDF sent by email. At first glance, each of these files only displays its visible content. However, behind that visible layer lies other information, automatically generated when the file is created, modified, or sent, which doesn't appear when it's opened and which, in certain contexts, can constitute key evidence in a criminal case.
This information is called metadata, and its analysis is now a common tool in the forensic investigation of computer crimes, but also in cases where the digital file is just one piece within a broader event: a threat, a fraud, a dispute over authorship, an alibi.
What is metadata?
Metadata is information automatically generated by the device or software when a file is created, modified, or transmitted. Unlike the file's content, it is not displayed when the file is opened with a standard program; extracting it requires specific technical tools capable of reading this information without altering it.
What information can a file contain?
The type and amount of metadata vary depending on the file format and the source device or software. A photograph might store the exact date and time it was taken, the GPS coordinates of the location, and the device model; a text document or PDF typically records the author, the user who last modified it, and the edit history.
Evidentiary value: what does it allow us to establish?