2007-12-08 Metadata Revisited - What's In That JPG? --- Relevant Evidence.

For those in the "most metadata is irrelevant" camp, I offer this argument in support of my position that metadata is critical to electronic evidence authentication: The metadata contained in most digital photographs can reveal camera ID, camera type, shutter speed, or aperture setting together with the more visible time and date notations. If someone accuses someone as having taken a certain photograph, it might be helpful to ascertain this information *(through discovery, of course) and then argue that the accused:

1. Owned or did not own the type of camera used to take the photo
2. The camera had or lacked the capability to take photos at the listed aperture, shutter or ISO setting
3. The camera had or lacked the capability to take photos at the claimed resolution.

The underlying metadata reliability argument quite readily exposes the gaping holes in the "most metadata is irrelevant" argument, as one might argue that the metadata showing these attributes (including the time and date source, and time and date notation) was unprotected, and subject to the same type of manipulation as is all other unprotected digital data, and is therefore unreliable. One might also present (and this is really the more difficult argument) that the metadata was generated and maintained in such a fashion as to be authentic and reliable. In other words, the metadata, like the photo itself, is what it purports to be at the time relevance attached to it.