Microsoft Office and Metadata Forensics
A Deeper Dive
Abstract
Metadata is often incredibly useful to a forensic investigator, helping to establish the “who, what, where and how” of computer-based activity. But metadata is also easy to misinterpret—or just miss altogether. This chapter explores some of the risks associated with analyzing metadata and the challenges of drawing reliable conclusions from such analysis. This chapter will focus on defining some of the specific issues encountered when analyzing Microsoft Office metadata, the most common file types forensic investigators encounter. Not only can metadata be altered intentionally to throw off an investigator, but the Microsoft ...
Get Computer and Information Security Handbook, 3rd Edition now with the O’Reilly learning platform.
O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.
