The area of the file referred to as 'Last 10 Authors' is also called metadata, however, it isn't contained in the same area or accessible through the same applications as the other metadata fields. The last 10 authors/locations information can greatly assist computer forensic examinations and electronic discovery projects, however, it is important to know which software tools can access and scrub the last 10 authors information.



Many don't realize that last 10 authors isn't normally displayed or made available when metadata is extracted or viewed through computer forensic software, electronic discovery extraction or metadata viewer utilities. The reason that last 10 authors remains hidden is that it doesn't fall into the OLE stream metadata category.

OLE stream metadata is what is visibile and often extracted through computer forensics, electronic discovery and several free utilities. Microsoft provides a dll library to allow software developers to easily access dozens of metadata fields (i.e. Title, Author, Date Last Printed, Date Last Saved etc.), however, the dll and other metadata libraries (as well as scrubbing utilities) don't provide access to the last 10 authors information.

Once an attorney realizes what information can be available from last 10 authors and locations they can be elated or very concerned depending on who they are representing. It is of additional concern when attorneys realized their scrubbing software or vendor didn't remove this information.

We were recently hired to review a couple computer systems and a USB drvie of a corporate employee. We were told that the two computers provided were the only systems that were used by the employee.

We were a bit suspicious when we were told the laptop was used whenever the suspect wasn't in the office. Our suspicions were a result of determining the laptop was 5 years old and contained partitions that included DOS and Windows 3.1.

When we reviewed the last 10 authors information on dozens of current working files located on the USB drive we were able to determine that none of the files were created or recently modified on the laptop. In fact, we were able to determine the employee had access to two other systems which had been used to edit the working files.

The last 10 authors provides not only the author but the location of the file. Additionally, the autosave feature in Word can cause the location of a file to be stored even if the user didn't manually save their documents.

There are dozens of examples like this where last 10 authors 'metadata' can be used to help with a conviction or judgement. Informaiton can work for or against an individual and their legal representation. When it is determined that metadata is priveledge information or for any reason should be excluded, don't forget about last 10 authors.

It is important to remember that not all metadata scrubbing applications remove the last 10 authors information, nor do most electronic discovery applications extract this content. Programatically, last 10 authors can be difficult to access and even more difficult to overwrite or remove.

In closing, metadata is valuable information that can help establish evidence timelines, file location and dozens of other facts related to a case. The last 10 authors metadata is extremely valuable but not easily accessible to common computer forensic and electronic discovery processes. Make sure you incorporate last 10 authors in your next project. Pinpoint Labs offers MetaViewer and MetaDiscover software tools as well as metadata consulting services.