Microsoft Word Metadata - Last 10 Authors Explained


Microsoft Office documents can contain a significant amount of data about a file referred to as Metadata. Metadata is stored within the file and the information when analyzed can be very useful in forensic examinations and electronic discovery.

One of the most valuable areas of information is referred to as 'Last 10 Authors'. Last 10 Authors/Locations is an area of a Microsoft Word file that, as it states, stores the last 10 authors and locations for the file.

Many don't realize that last 10 authors isn't normally displayed or made available when metadata is extracted or viewed through computer forensic software, electronic discovery extraction or metadata viewer utilities. The reason that last 10 authors remains hidden is that it doesn't fall into the OLE stream metadata category.

Microsoft OLE Metadata
OLE stream metadata is what is visible and often extracted through computer forensics, electronic discovery and several free utilities. Microsoft provides a dll (library) which allows software developers to easily access dozens of metadata fields (i.e. Title, Author, Date Last Printed, Date Last Saved etc.), however, the dll and other metadata libraries don't provide access to the last 10 authors information.

Many attorneys are concerned when they realize the information that is contained in their client's files in the last 10 author area. They become even more concerned when they realize their scrubbing software didn't eliminate the information in this area.

Locate Additional Evidence Sources
You may be asking yourself, what's the big deal? How does this affect me? In a recent computer forensic exam we were provided a laptop of the suspect and told that it was the computer they used outside of the office. It was claimed that no other computer was used for work related files.

We suspected that due to the age of the laptop and that there was very little information on the computer that the suspect provided us with a computer that had been retired and wasn't in use as stated.

Last 10 Authors is Excluded from Most EED Processing
It was the last 10 authors that allowed us to prove that not only had the laptop not been recently used to create, modify or save any work related files last 10 authors also allowed us to identify two other systems the individual had access to that were never produced for the case. Additionally, the auto save feature in Microsoft Word will update the metadata.

There are dozens of examples like this where last 10 authors 'metadata' can be used to help with a conviction or judgment. Information can work for or against an individual and their legal representation. When it is determined that metadata is privilege information or for any reason should be excluded, don't forget about last 10 authors.

It is important to remember that not all metadata scrubbing applications remove the last 10 author's information, nor do most electronic discovery applications extract this content. Programmatically, last 10 authors can be difficult to access and even more difficult to overwrite or remove.

In summary, the last 10 authors is referred to as metadata, however, it isn't accessible through most computer forensic or electronic discovery applications. Last 10 authors and location information can be viewed and scrubbed using Pinpoint Labs MetaDiscover.

Jonathan P. Rowe
President and CEO
Pinpoint Labs
www.pinpointlabs.com
jon.rowe@pinpointlabs.com