What Is Metadata?
Every digital file carries invisible information about itself — data about data. This is metadata, and it can reveal far more than the visible content of a file.
When you take a photo, your camera doesn't just save the image. It embeds the date, time, GPS coordinates, camera model, lens settings, and more. When you save a Word document, it records the author, creation date, last edit time, and revision history. When a web page is served, headers contain the server software, content type, and caching instructions.
This hidden layer of information can serve as powerful evidence — or, if overlooked, can inadvertently leak sensitive personal data.
Types of Metadata
EXIF Data (Images)
EXIF (Exchangeable Image File Format) is embedded in JPEG and TIFF files by cameras and smartphones. Common EXIF fields include:
- Date and time — When the photo was taken (from the device clock)
- GPS coordinates — Exact latitude and longitude of the capture location
- Device information — Camera make, model, and serial number
- Image settings — Aperture, shutter speed, ISO, focal length
- Software — Editing software used, if any modifications were made
Document Metadata
Office documents (Word, Excel, PDF) contain:
- Author name — Often the user account name on the creating computer
- Creation and modification dates — When the file was first created and last changed
- Revision count — How many times the document has been edited
- Hidden content — Track changes, comments, and previous versions may be embedded
- Print history — When and how many times the document was printed
Web Page Metadata
Web content includes metadata in:
- HTTP headers — Server type, content encoding, cache directives, cookies
- HTML meta tags — Page title, description, author, Open Graph tags
- TLS certificates — Domain ownership, certificate authority, validity period
- Response timestamps — Server-reported date and time
Metadata as Evidence
Proving Timing
Metadata timestamps can establish when a file was created or modified. In intellectual property disputes, the creation date of a design file can prove who created something first. In employment cases, document modification dates can reveal when records were altered.
Proving Location
GPS coordinates in photos have been used in court to prove that someone was at a particular location at a specific time — contradicting alibis or confirming presence at a crime scene.
Proving Authenticity
If a photo's EXIF data shows it was taken with an iPhone 15 on March 3, but the opposing party claims it was taken with a Samsung on March 10, the metadata directly contradicts their claim.
Detecting Manipulation
When an image is edited, many editing tools update the EXIF software field. A photo that claims to be an original but shows Adobe Photoshop in its metadata has clearly been processed. Similarly, a "first draft" document with a revision count of 47 raises questions.
The Risks of Metadata
Unintentional Information Leaks
Metadata can expose information you didn't intend to share:
- Sharing a photo online may reveal your home address via GPS coordinates
- Sending a document may expose your real name, organization, or computer username
- Screenshots may contain display resolution, operating system, and color profile data
Metadata Stripping
Some platforms (social media, messaging apps) automatically strip metadata from uploaded files to protect user privacy. While this is good for personal safety, it destroys potentially valuable evidence. A photo downloaded from social media typically has no EXIF data — the platform removed it during upload processing.
This is one reason why capturing the original web page — rather than downloading individual images from it — produces stronger evidence.
How TrueSnap Preserves Metadata
When TrueSnap captures a web page, it preserves multiple layers of metadata that would otherwise be lost:
- HTTP response headers — Recorded in the HAR (HTTP Archive) file, capturing exactly what the server sent
- TLS certificate data — The complete certificate chain, proving the server's identity at the time of capture
- Capture environment details — URL, IP address, timestamp, and browser configuration stored in metadata.json
- DOM metadata — HTML meta tags and embedded structured data preserved in the DOM snapshot
This comprehensive metadata collection creates a richer evidentiary record than any single file type could provide.
Practical Advice
If You Are Collecting Evidence
- Do not edit files before using them as evidence. Editing updates metadata and may overwrite original values.
- Preserve originals — Always keep an unmodified copy. Work with duplicates if you need to view or process files.
- Capture web pages forensically — Tools like TrueSnap preserve server-side metadata that screenshots cannot capture.
- Note the source — Record where and how you obtained each file, since metadata alone may not tell the full story.
If You Are Reviewing Evidence
- Check for consistency — Do timestamps in the metadata match the claimed timeline?
- Look for editing indicators — Software fields, revision counts, and modification dates can reveal post-capture changes.
- Verify completeness — Missing metadata fields may indicate the file was processed or stripped.
Key Takeaway
Metadata is the silent witness embedded in every digital file. It records when, where, how, and by whom a file was created or modified — often without the creator's awareness. For legal evidence, preserving this metadata is as important as preserving the visible content itself. A forensic capture that includes metadata provides context and verifiability that a simple screenshot never can.