[IPlawyertoo]

Can anyone tell me if they know for sure whether or not metadata is
definitvely compromised if it shows the last print date predates a creation
date. One would think the answer is yes but i recently deposed a police
forensic moonlighting expert who explains away metadata in his report where
the last print date precedes the create date in the metadata explaining if
you print document 1 on day 1 and send it to another computer on day 5 and
rename the document or otherwise revise it but do not print it the last print
date of day 1 appears in the metadata of a new document showing a creation
date of day 5. The defendant and my client the plaintiff are at odds with a
court on possible perjury over who tampered with documents and I think the
metadata shows conclusive tampering but the defendant's expert says he
recreated this hypothetical which i could not nor could my IT person. Anyone
help me on this! it is very important to my client? thanks.
--
Jeff G.

[Tony Jollans]

Can anyone tell me if they know for sure whether or not metadata is
definitvely compromised if it shows the last print date predates a
creation
date.

This situation can and does happen routinely. It is not evidence that the
metadata is compromised.

--
Enjoy,
Tony


"IPlawyertoo" wrote in message
...
Can anyone tell me if they know for sure whether or not metadata is
definitvely compromised if it shows the last print date predates a
creation
date. One would think the answer is yes but i recently deposed a police
forensic moonlighting expert who explains away metadata in his report
where
the last print date precedes the create date in the metadata explaining if
you print document 1 on day 1 and send it to another computer on day 5 and
rename the document or otherwise revise it but do not print it the last
print
date of day 1 appears in the metadata of a new document showing a creation
date of day 5. The defendant and my client the plaintiff are at odds with
a
court on possible perjury over who tampered with documents and I think the
metadata shows conclusive tampering but the defendant's expert says he
recreated this hypothetical which i could not nor could my IT person.
Anyone
help me on this! it is very important to my client? thanks.
--
Jeff G.

[Doug Robbins - Word MVP]

I would suggest that you Google for metadata tampering.

--
Hope this helps.

Please reply to the newsgroup unless you wish to avail yourself of my
services on a paid consulting basis.

Doug Robbins - Word MVP

"IPlawyertoo" wrote in message
...
Can anyone tell me if they know for sure whether or not metadata is
definitvely compromised if it shows the last print date predates a
creation
date. One would think the answer is yes but i recently deposed a police
forensic moonlighting expert who explains away metadata in his report
where
the last print date precedes the create date in the metadata explaining if
you print document 1 on day 1 and send it to another computer on day 5 and
rename the document or otherwise revise it but do not print it the last
print
date of day 1 appears in the metadata of a new document showing a creation
date of day 5. The defendant and my client the plaintiff are at odds with
a
court on possible perjury over who tampered with documents and I think the
metadata shows conclusive tampering but the defendant's expert says he
recreated this hypothetical which i could not nor could my IT person.
Anyone
help me on this! it is very important to my client? thanks.
--
Jeff G.

[Graham Mayor]

You cannot use metadata to *prove* anything. The various dates stored in
metadata can easily be changed using Word's own script editor. You would
have to show corroborative evidence to show that the metadata had been
tampered with. You can even add a print date when the document hasn't been
printed.

The Metropolitan Police in London has an excellent computer crime section.
They may be willing to advise what is currently possible in the way of
forensic disc analysis, but this would require the disc from the computer on
which the document was allegedly created.
--

Graham Mayor - Word MVP

My web site www.gmayor.com
Word MVP web site http://word.mvps.org


IPlawyertoo wrote:
Can anyone tell me if they know for sure whether or not metadata is
definitvely compromised if it shows the last print date predates a
creation date. One would think the answer is yes but i recently
deposed a police forensic moonlighting expert who explains away
metadata in his report where the last print date precedes the create
date in the metadata explaining if you print document 1 on day 1 and
send it to another computer on day 5 and rename the document or
otherwise revise it but do not print it the last print date of day 1
appears in the metadata of a new document showing a creation date of
day 5. The defendant and my client the plaintiff are at odds with a
court on possible perjury over who tampered with documents and I
think the metadata shows conclusive tampering but the defendant's
expert says he recreated this hypothetical which i could not nor
could my IT person. Anyone help me on this! it is very important to
my client? thanks.