Microsoft Word contains hidden information regarding a documents characteristics, when it was created, edited and which author modified the document. In addition to the visible text in a Microsoft Word document there is also information which isn't visible that track the document through creation and revision.



In a legal matter electronic files are considered evidence. It would stand to reason that metadata in Microsoft Word files is important since it can explain the timeline of events and other details related to the evidence.

Several file types contain metadata; however, the topic of this paper is to understand how Microsoft Office metadata is relevant to a civil litigation. Now, you may ask what about email ?metadata??

The information in emails commonly referred to as ?metadata? which includes ?To:?, ?From:?, ?CC? etc. are actually database fields and aren't hidden. The purpose of this article is to deal with the hidden information contained in files related to Microsoft Office documents.

In addtion to Microsoft office Word metadata there is file system metadata. File system metadata is stored outside of the Microsoft Word.

File system metadata is independent of the Microsoft Office metadata and is stored in the FAT (File Allocation Table) which is similar to a table of contents for the operating system (i.e. .Microsoft Windows).

File system metadata is relevant for a different reason. Spoliation often refers to the improper collection of electronic files when the file system metadata is altered during collection.

When collecting files from a custodian machine during a document production it is important to preserve all aspects of the original file. Unfortunatley, simply copying files in Windows will alter file timestamps and metadata. Pinpoint Labs created a program called SafeCopy that allows users to copy files to a new location without altering metadata.

The folowing paragraph contains a list of the common metadata fields contained in a Microsof Word document.

MICROSOFT WORD METADATA FIELDS- Last Saved By, Word Count, Page Count, Paragraph Count, Line Count, Character Count, Chars, Byte Count, Presentation Format, Slide CountNote Count, Hidden Slides, Multimedia Clips, Last 10 Authors, Routing SlipTrack Changes, Fast Saves, Hidden text, Graphics Hyperlinks, Document Variables, Include Fields, File Name, Title, Author, Comments, App Name, Version Date, Created Date, Last Printed, Date Last Saved, Total Edit Time, Template, Shared, Subject, Category, Company, Keywords, Manager.

Pinpoint Labs developed a free tool called Metaviewer which displays both the file system metadata and internal metadata for several file types. Metaviewer also calculates hash values for MD5, SHA-1 and SHA-256. Metaviewer is a great tool for forensic examiners and litigation support professionals. You can download a free copy of Metaviewer from Pinpoint Labs website.