Document Metadata and Computer Forensics


Author(s) Jeffrey R. Jones
TR-Number JMU-INFOSEC-TR-2006-003
Abstract Metadata contained within documents serves a valid purpose in many circumstances, such as facilitating the collaboration among a group of people. However, many are not aware of the type of information stored with their documents, spreadsheets, and presentations. Due diligence is required by responsible users to ensure that sensitive information is not leaked to third-parties. Until then, forensic investigators could have access to a plethora of hidden document information. This paper examines how metadata is used in PDF documents and documents, spreadsheets, and presentations created in Microsoft Office and OpenOffice.org. Several instances are examined where metadata has led to the discovery of hidden information. This paper also shows how metadata is stored in documents, spreadsheets, and presentations created in the aforementioned applications. Finally, this paper will test and discuss the functionality of several tools available to users and investigators that test for the presence of metadata.
Sponsor Prof. Florian Buchholz
Contact e-mail techreports@cs.jmu.edu