From ForensicsWiki
Jump to: navigation, search


  • It can provide corroborating information about the document data itself.


Kinds of Metadata

Some kinds of metadata that are interesting in computer forensics:

  • Digital image metadata. Although information such as the image size and number of colors are technically metadata, JPEG and other file formats store additional data about the photo or the device that acquired it.
  • Document metadata, such as the creator of a document, it's last print time, etc.

File types that support metadata and extraction tools


EXIF (JPEG and TIFF image files; Music Files)
The Exchangeable Image File format describes a format for a block of data that can be embedded into JPEG and TIFF image files, as well as RIFF WAVE audio files. Information includes date and time information, camera settings, location information, textual descriptions, and copyright information.
ID3 (MP3 files)
Implemented as a small block of data stored at the end of MP3 files. ID3v1 is a 128-byte block in a specified format allowing 30 bytes for song, artist and album, 4 bytes for year, 30 bytes for comment, and 1 byte for genre. ID3v1.1 adds a track number. ID3v2 is a general container structure. For more information, see [1].
Microsoft OLE Compound File
Microsoft Office document files contain a huge amount of metadata. They are created as OLE Compound Files and mainly stored in the so called property set streams. Here are some tools for processing them:

See Also


External links