For the Defense - Volume 2, Issue 4 - 2017 - 46

Meta and EXIF Data
Metadata is everywhere. Its definition is "data
about data" and it exists for every single digital
file that has ever been modified, accessed, or
created. These timestamps, or MAC times, are
the most basic of metadata. All files on a digital
storage medium will have this information associated with it. Different types of files can have vast
troves of metadata embedded in them. Microsoft
Word documents will contain information including the last author's name, the last time the file
was printed, and even a revision tracker. Adobe
PDF files often contain information about what
software produced them, how many pages long
the file is, and what computer it was originally
stored on.
One of the most common types of metadata
associated with digital forensics is called EXIF data
(short for "exchangeable image file format," but
more commonly known as "extra information").
EXIF data is attached to pretty much any media
file generated by a modern smartphone or digital
camera - including pictures, videos, and audio
recordings. Any photo taken on your phone
or digital camera will contain EXIF data with
information such as GPS coordinates of where a
picture was taken, whether or not the flash fired
during the photo, and even what the aperture
and shutter speed of the camera was. Similar data
is recorded for video and audio recordings too.
An MP3 file will often contain useful information
such as copyrights, track number, album and artist
names, etc., but EXIF data also allows images
themselves to be embedded as metadata - typically to be used as a preview thumbnail. However,
this can be manipulated or changed for nefarious
purposes. In this scenario, you could easily end
up with what looks to be a bunch of music from
iTunes on the surface but actually, contains case-related images and information in the metadata.

Computers
Even though mobile is taking the world by storm,
the personal computer is still one of the main
sources of hidden information in the forensic
world. Windows, Mac, and Linux all log pretty
much everything a user does in one form or

For The Defense | Vol. 2, Issue 4

another. Common artifacts include browsing
history and recovering of deleted files, but there
is much more information hidden beneath the
surface. A trained forensic examiner can look
through hidden registry files and find out not
only the exact time a USB flash drive was plugged
in, but also the company who made it, and more
importantly what was copied onto it before being
unplugged.
Have you ever typed anything into that Start
Menu search bar on Windows? Or asked Cortana or
Siri a question, even by mistake? Just like "deleted"
doesn't really mean deleted, "off" doesn't always
mean off. Even when a user turns their history or
logging off, there are hidden references to these
queries buried deep within the operating system,
and with the right tools and knowledge they can
be extracted and used as evidence.

Mobile Devices
In today's society, everyone has a smartphone with
them all day long. These devices store a wealth of
information usable for criminal investigations. It
is not just about what you can see in your phone
that has investigative value. With the help of a
digital forensic examiner, deleted content can
often be recovered. This can include text messages
dating all the way back to when the phone was
first used, as well as photographs taken on the
phone, even if the user deleted them. Deleted
doesn't really mean it is gone. Further, many times
cloud backups can contain data about phones that
may be lost or damaged. So, this can mean that
lost doesn't mean the data is gone.
In a defense case, we frequently need location
information. A common source is Call Detail
Records (CDRs) which are maintained by the cell
phone companies. This data allows examiners to
determine the general geographic region within a
few square miles of where a phone was at a given
time. These records are gathered via subpoena and
yield cell-site and sector information. Examining
this data allows us to tell which tower the phone
used for a call or text, and the direction from the
tower the phone was at that time. This is the kind
of surface data that is classically associated with
mobile phone forensics, and is standard operating

Table of Contents for the Digital Edition of For the Defense - Volume 2, Issue 4 - 2017