Metadata, and What It Actually Records
Metadata is spoken about as though it were a hidden confession attached to every file. It is a great deal more mundane and a great deal more useful than that: a set of technical facts recorded automatically, which survive only if nobody handles the file carelessly.
The rule in short
Metadata is information about a file rather than in it: when it was created and modified, by which account and application, and for images and messages a range of device and transmission details. It is generated automatically, which makes it hard to fake convincingly, and it is stripped or overwritten by ordinary handling, which makes preservation the whole exercise.
Every digital file carries a layer of information describing itself, recorded by whatever system produced it. That layer answers questions the content cannot, and it is destroyed by exactly the kind of handling that files receive when somebody is trying to be helpful.
What metadata actually contains
Creation and modification times. Recorded by the file system and by the application, and frequently differing from each other, which is itself informative about how a file was handled after it was made.
The account and application involved. Documents record the software that produced them and often the account name registered to it, which is one of the more useful attribution signals available.
Camera and image details. Photographs carry the make and model of the device, exposure settings, and in many cases the location where the image was taken and the orientation of the camera.
Message transmission details. Messages carry identifiers, precise timestamps and routing information in the underlying data, none of which appears in the interface anybody looks at.
Revision history in some formats. Word processing and spreadsheet formats can retain earlier text, tracked changes and author names, which occasionally reveals a good deal more than the visible document does. That residue is removed by converting the file to a fixed format.
Why it is useful
It was generated rather than written. Nobody typed a creation timestamp, so it carries none of the intention that ordinary evidence does, and that is exactly what makes it credible.
It answers questions content cannot. When a document was actually produced, whether a photograph was taken where somebody says it was, and whether a file was modified after it was supposedly finalized.
It exposes assembled documents. A file created ten minutes before it was sent, with an author name belonging to somebody else, tells a story the visible text does not.
It corroborates or contradicts. Metadata rarely decides a case on its own, and it frequently confirms or undermines an account in a way nobody involved anticipated.
It survives selective production. A party producing a document in native format hands over the metadata whether or not they thought about it, which is why native production matters so much.
| Handling | Metadata preserved | Note |
|---|---|---|
| Copied at file level | Yes | Timestamps intact |
| Emailed as an attachment | Usually | Depends on the client |
| Sent through a messaging platform | Often not | Images are commonly re-encoded |
| Printed to a document format | Mostly lost | A new file is created |
| Screenshotted | Entirely lost | The image is of a screen |
How it is destroyed
Screenshots remove everything. An image of a screen carries the metadata of the screenshot rather than of the underlying file, which is the point made in why screenshots prove little.
Copying and converting strips it. Printing to a document format, re-saving, or uploading to a platform that re-encodes an image each remove some or all of the original layer.
Platforms strip images deliberately. Most messaging and social platforms remove location and camera data from uploaded photographs, so an image received through one carries very little.
Opening a file can change it. Modification timestamps update when a file is saved, and some applications rewrite files on opening, which is why working copies are made before anything is examined.
Transfer methods vary. Sending a file as an email attachment usually preserves the layer intact, while sending the same file through a platform that compresses or re-encodes it usually does not.
The single most effective step in preserving metadata is a written request, at the start of a disclosure exercise, that documents be produced in the form in which they are held. Once material has been printed or converted, the layer is gone and no later request recovers it.
The limits
Timestamps depend on clocks. A device with a wrong clock records wrong times, and a device that changed time zone records times that need interpreting rather than reading.
Time zones are recorded inconsistently. Some formats store an offset and some store only a local time, so the same instant appears differently depending on the format and the software reading it.
Metadata can be edited. Tools to change it are freely available, so metadata supports an account rather than proving one, and corroboration from an independent source still matters.
Absence proves little. A file with no metadata has usually been through a platform or a conversion, and the absence is far more likely to reflect handling than concealment.
It describes files, not people. An author name is an account setting, and a location is where a device was, neither of which establishes who was holding it.
Preserving it
Request native format. Explicitly, at the outset, because a request for documents answered with printed pages has lost the layer before anybody noticed, as format in a production sets out.
Copy at the file level. Using a method that preserves timestamps rather than opening and re-saving, which is a technical distinction with a large practical effect.
Work on copies. Examination is done on a duplicate so that the original retains its state, which is the same discipline as preserving a device.
Record the chain. Who obtained the file, when, by what method, and what was done to it, because a file whose handling cannot be described invites questions about its metadata.
Extract early. A report of the metadata generated when the file is first obtained fixes what it contained at that point, whatever happens to the file afterward.
Metadata earns its reputation because it is generated rather than composed. A timestamp written automatically by a system carries no intention, which is precisely what makes it more reliable than most of the material around it.
Its fragility is the counterpart of that. The same automatic quality means it is overwritten and stripped by ordinary handling, and the handling is usually done by somebody trying to be helpful with a screenshot or a printout.
The limits deserve stating plainly, because metadata is regularly over-claimed. Clocks are wrong, time zones are recorded inconsistently, editing tools exist, and a location records where a device was rather than who was carrying it.
In practice its most common role is corroboration. A document whose metadata is consistent with the account given about it is a document that has survived a test; one whose metadata contradicts that account has raised a question nobody can easily answer.
Everything therefore turns on the first few hours. A file obtained in native format, copied properly, examined on a duplicate and documented at the point of collection retains everything. A file that arrives as a printout has already lost it. Where the time an image was taken is what matters, the pitfalls are set out in photographs.
Points to carry away
- Metadata describes the file rather than forming part of its content.
- It is generated by systems, which is the source of its value.
- Ordinary handling strips or overwrites much of it.
- Timestamps depend on device clocks and time zones.
- It can be edited, so corroboration still matters.
Questions readers ask
Can metadata be trusted?
It is more reliable than most evidence and it is not conclusive. Its value comes from being generated automatically rather than composed by somebody with an interest in the outcome, which makes casual falsification unlikely. Against that, tools for editing metadata are freely available, device clocks are frequently wrong, and time zone handling differs between formats. The sensible position is that metadata supports or undermines an account, and that a case resting entirely on it without corroboration is a fragile one.
Why do photographs sent through messaging apps lose their location data?
Because most platforms re-encode uploaded images, both to reduce their size and, in many cases, deliberately to remove information users may not realize they are sharing. The image that arrives is a new file generated by the platform, carrying the platform's own minimal metadata rather than the camera's. That is why an original photograph obtained from the device or from a photograph library is worth considerably more than the same image received through a chat application.
What does it mean if a file has no metadata at all?
Usually that it has been handled, converted or passed through a platform, rather than that anybody removed it deliberately. Printing to a document format, uploading to a service, or saving a copy through certain applications all produce files with little or nothing left. Because innocent explanations are so common, the absence of metadata is a weak basis for any allegation, and the productive response is to ask for the file in the form the producing party actually holds it.
Sources
- Federal Rules of Civil Procedure — Rule 34, Producing Documents and Electronically Stored Informationlaw.cornell.edu
- Federal Rules of Civil Procedure — Rule 26, Duty to Discloselaw.cornell.edu
- Federal Rules of Evidence — Rule 901, Authenticating or Identifying Evidencelaw.cornell.edu
- Federal Rules of Evidence — Rule 1001, Definitions That Apply to This Articlelaw.cornell.edu
- Federal Rules of Civil Procedure — Rule 37, Failure to Make Disclosureslaw.cornell.edu
- National Institute of Standards and Technology — Publicationsnist.gov
True Justice Record is a publication, not a law firm. This article states general rules and cites its sources; it is not advice about any particular case, and the law differs by state and changes over time.
More in Evidence That Lives on a Phone
When a Device Is Lost or Wiped
Where a device is gone, provider-held account data is unaffected, backups may capture an earlier state, and the other participants in any conversation hold their own copies. The circumstances of the loss then matter separately: an ordinary loss is neutral, while a wipe performed after a duty to preserve arose is treated as spoliation.
Voice Notes and Recordings
A recording is authenticated by evidence of how it was made and by whom, identification of the voices on it, and confirmation that it is complete and unaltered. Transcripts are aids rather than evidence. Editing is easy and increasingly hard to detect, so provenance carries more weight than any examination of the audio itself.
Location History Offered as Evidence
Location evidence comes from satellite positioning, from network cell sites, from wireless network observations and from application check-ins, each with a different accuracy. All of it places a device rather than a person. Interpreting it responsibly means establishing which method produced each point and what margin that method carries.