Computer Forensics with Metadata Forensics

The term “forensics” is common only to crime investigations of dead body or crime scene. But there is also what people call as computer forensics. The goal of computer forensics is just the same with the common forensics—to explain how the current state of a digital artifact came into its present form. This process is sometimes called as the digital forensics and may include investigating the computer system, the storage media, electronic documents, email messages, audio files, video files, and image files. Computer forensics follows the five basic steps which are the Preparation, Collection, Examination, Analysis, and Reporting. There may be a lot of things to be done in a computer forensics but among the most important element that experts often look into is the metadata. Looking into the metadata is often referred to as metadata forensics.

Metadata is simply a data or information about a certain data. In computer forensics, metadata plays several important roles. One of these is providing the corroborating information regarding the data in a certain document. Metadata can also reveal information that may be hidden, obscured, or deleted by a person. It also helps in computer forensics through automatically using correlate documents from various sources.

There are a lot of metadata that can be found in computer files but for computer forensics, only few of these are considered interesting. Included to these are the metadata about the file system and the digital image.

Moreover, some metadata formats that are also useful in computer forensics are the EXIF, ID3, Microsoft OLE 2, and TIFF.

Although some users find metadata as revealing sensitive information, some may still find it very useful. Anyway, those who do not want to reveal sensitive information through metadata can find ways on how to delete or hide them.