Outline of Craig Ball's Electronic Discovery Workbook Part 8 - Meta Data

Here's a continuation of my outline of the 2016 edition of Craig Ball's Electronic Discovery Workbook which I last posted about on April 1, 2017.

XI. Introduction to Meta Data A. Information and Evidence a. Not just ‘data about data’. b. Metadata is information stored electronically that describes the characteristics, origins, usage, structure, alteration and validity of other electronic information. c. Williams v. Sprint (D. Kan. 2005) – electronic documents should be produced with their metadata intact, unless there is a timely objection, the parties agree metadata should not be produced, or the producing party requests a protective order. B. Types of Meta Data a. We need data that tells data’s encoding scheme. b. Some metadata is invisible and can only be viewed with a Hex Editor – e.g. master file table showing where 0’s and 1’s for a particular file begin and end. c. Other metadata not essential to operation of system – e.g. when file created or modified. C. File Systems and Relative Addressing a. Relative addressing – locating something by saying that it’s a certain number of units (the offset) from a particular point. Computers use offset values to locate files on stored drives and information in those files. b. Offset values can be bits, bytes (8 bits), or sectors (512 bytes); clusters (8 sectors). Bytes are used for the location of information in files, and sectors are used for the location of files on storage media. D. Application and System Metadata a. Application metadata – such as the ability to undo changes – is embedded in the file. b. System metadata – track file locations and store file name’s size, creation, modification and usage. c. Windows uses Master File Table to keep track of system metadata. d. DOS used the File Allocation Table to track system metadata. e. Windows calls any individual piece of content, such as a file or folder, a shell. Metadata associated with a shell is a property. f. There are 284 metadata properties in 28 property categories. These can be displayed by right clicking on column headings in a folder

g. Digital photos have EXIF metadata re: date, time, geolocation, camera settings. h. MS Outlook uses more than 180 different metadata fields. i. Windows System Registry tracks thousands of registry keys.

E. Relevance of Metadata a. Sedona Conference Principle 12 – production should be made in the form in which it is ordinarily maintained or a reasonably usable form, taking into account the need to produce metadata. b. Comments to FRCP 2015 amendments note that framing request for ESI may require detailed information about other party’s information systems. – Metadata is discoverable for its utility and its relevance. c. Essential metadata files for any file i. Custodian ii. Source Device iii. Originating Path iv. Filename v. Last Modified Date vi. Last Modified Time d. UTC time zone offset e. Essential Email metadata i. Custodian ii. To iii. From iv. CC v. BCC vi. Subject vii. Date Sent viii. Time Sent ix. Attachments x. Mail Folder Path xi. Message ID F. Production of Metadata a. Gauge Spoliation Risks – i. Last Accessed Data used to be updated by virus scans and by previewing files. This does not happen with Operating Systems since Win 7. ii. Created Date is not when the file was created, but when file was created in the file system of a particular medium. iii. Automatic changes to application metadata may cause the last modified date to be changed. iv. Calculate hash values of pristine files. b. Identify Forms of Metadata c. Assess Relevance i. Adobe PDF files have PDF Producer and PDF Version under Document Properties. PDF Producer indicates the source application, and PDF Version tracks the release of Adobe software used to create the PDF. d. Collect Metadata i. Zipping file may preserve associated metadata. ii. CD-R discs will only store one date for the modified, accessed, and created fields. e. Review Metadata for Privilege i. Williams v. Sprint (D. Kan. 2005) – concerns about privileged led defendant to strip out metadata from native spreadsheets. Court ordered all metadata produced save only privileged and expressly produced metadata. f. Resolve Production Issues i. Metadata may be unintelligible outside is native environment. It may consist only of a flag in an index entry – just a one or zero