A good attorney would never purposely ignore relevant information or leads during discovery. But if you are not requesting and reviewing metadata, you may be inadvertently overlooking invaluable impeachment evidence or information that leads to an unexpected witness.

What is Metadata?

As a brief primer, metadata is often described as “data about data.” It provides contextual information and descriptive details about a piece of data or content, without being the primary content itself. In essence, metadata acts like a label or a set of tags attached to a piece of information. For example, in the case of a digital photograph, the image itself is the primary data, while metadata might include details such as the date and time the photo was taken, the camera model used, the location where it was shot and even the camera settings. Metadata can be found in various forms across different types of digital content and systems. In documents, it might include the author’s name, creation date and version number. For websites, metadata can encompass keywords, descriptions and other Search Engine Optimization- (SEO) related information. In databases, it often describes the structure, relationships and properties of the data stored. While the sources are almost endless, let’s focus on metadata sources frequently encountered by lawyers in the form of discovery documents: PDFs, emails and images.

Is Metadata Discoverable in Tennessee?

Yes. Rule 26.02 of our Rules of Civil Procedure impliedly allows for discovery of metadata, subject to the standard considerations of relevancy and proportionality to the case. Parties may discover any relevant matter “including the existence, description, nature, custody, condition and location of … electronically stored information, i.e. information that is stored in an electronic medium and is retrievable in perceivable form …” Tennessee’s Court of Appeals has also impliedly condoned discovery of metadata.¹

What Information Can Be found?

It varies to some extent based on the file type of the document at hand, but general examples include usage patterns (Who accessed which files and when?), trends (Did a former employee access proprietary information more frequently than usual shortly before defecting to a competitor?), geospatial insights (Was this photo actually taken at the scene?), authenticity (Who created this file? Does it have an AI watermark indicating it was generated by AI software?), and chain of custody information (Who has a certain file, where did they get it and with whom did they share it?). In addition to being useful information in its own right, metadata often provides leads for further investigation that would not otherwise be apparent.

How Do I View and Analyze Metadata?

Again, it varies based on document type, but the general methods are operating system tools (viewing “Properties” in Windows or “Get Info” on macOS), document-related applications like Adobe Acrobat, specialized platforms like Relativity and, of course, forensic analysis by an expert. As you might expect, different tools and methods vary widely in cost and depth of information. Forensic expert investigations are often the most thorough method, but free options like operating system tools and inexpensive options like Adobe can still be valuable sources of information.

What Can I Find in PDFs?

PDF (Portable Document Format) files contain a wealth of metadata that can provide valuable insights about the document’s creation, modification and content. The following is a detailed look at the information that can be gathered from PDF metadata.

Document Properties
At its core, the metadata reveals the PDF’s fundamental properties. It can provide the title, author, subject and keywords, giving a glimpse into the content without even opening the file. It also records the exact moment of the document’s birth and every time it is modified, creating a timeline that can be invaluable in legal proceedings.

Origins of the PDF
Information on a PDF’s origins include the application used to create the PDF; its version number can provide insights into compatibility issues or even help in forensic investigations. This information, combined with file system metadata like the file name, size and various timestamps, paints a picture of the document’s life cycle.

Structure
The presence of form fields, annotations or digital signatures all contribute to understanding the document’s complexity and purpose. Who made a comment, when did they make it, and what did they say? Among other things, this can be particularly valuable in disputes that arise out of protracted contract negotiations.

Embedded Elements
Additional content may be embedded within the PDF — images, fonts and other resources. Each of these elements carries its own metadata, potentially revealing the origins of inserted content or providing links to other documents or sources. In cases where the PDF was created from other document types, this embedded metadata can offer a trail back to the original files. Again, more leads to potentially overlooked sources of information.

Security Settings
Information about encryption status and specific permissions for actions like printing, copying or editing can be found. In addition to helping prove certain claims, this information could be used defensively. For example, metadata showing a document was not printed, copied or shared could help defeat a claim that a trade secret was misappropriated or that an NDA was violated.

Trend Spotting
When dealing with large numbers of PDFs, metadata can provide insights into document management practices, identify trends or flag anomalies that might otherwise go unnoticed.

What Information Do Photos and Images Contain?

Photo and image files contain a rich array of metadata that can provide valuable insights about the image’s creation, modification and content. Different image file formats (common types are JPEG, PNG, HEIC, TIFF and RAW) may contain varying amounts and types of metadata. Note that data is typically recorded by both the camera and the software that creates and processes the image. In addition to operating system tools and Adobe, photo viewer applications like the native Photos application on iPhones are a good, inexpensive option for investigating photos and images. There are also more sophisticated programs which tend to provide a greater depth of information.

EXIF Data
EXIF data is a digital fingerprint left by the camera at the moment of capture. It records the exact time and date the shutter clicked, the make and model of the camera, and even the precise settings used — aperture, shutter speed, ISO and focal length. For photos taken with GPS-enabled devices, it can even pinpoint the exact location where the image was captured, adding a geographical dimension to the story. This can be invaluable in litigation — was the photo of the damaged bumper really taken at the scene immediately after the accident?

IPTC Data
This data adds context about the image’s creator, copyright status and descriptive elements like titles and keywords. One obvious use in discovery is determining or confirming who took a photo.

XMP Data
The XMP data tracks the image’s journey through various editing software, creating a digital paper trail of modifications and enhancements. It can provide a detailed history of any changes made to an image, allowing a litigant to show that a photo was altered or to prove its authenticity.

File System Data
The file system records when the file was created, last modified and accessed. This can be critical in verifying timelines or tracking the lifecycle of an image. In a criminal context, this might be critical to corroborate an alibi by confirming that a photo of a defendant away from a crime scene was taken at the time of the crime.

What Information Can Be Found in Email (.eml, .msg) Files?

Email metadata contains a wealth of information about the transmission, routing and handling of messages.

Header
The header is essentially a digital passport stamping every stop along the email’s route. It shows not just who sent the message and to whom, but precisely when it was sent, down to the second.

IP Addresses
The metadata offers information about the path the email took by recording IP addresses of sending and receiving servers. Although the servers (computers) from which emails are sent or to which they are delivered are not always in the same physical location as the sender or recipient, particularly when using corporate IT systems, they often do correspond to physical locations with individual users’ devices. Free web resources like whatsmyIPaddress.com allow users to enter IP addresses to determine the geographical location associated with the address. Here, the possibilities include identifying a sender or recipient’s location or discovering that a corporate litigant maintains servers — and perhaps other equipment and operations — at an unexpected location.

Authenticity and Verification
Email metadata plays a vital role in authentication. It carries the results of sophisticated checks like SPF, DKIM and DMARC, which are cryptographic signatures that help verify the authenticity of the sender.

Digital Environment
The metadata also provides information about the sender’s digital environment. It reveals the email client used to compose the message and can hint at the operating system of the sending device. Say a witness testified that he only sent work-related emails from his work laptop — a Windows device — but the metadata suggests a work email was sent from macOS, the operating system for Apple computers. Now you may have grounds for an inspection of his personal Mac laptop.

Final Notes

Requesting and reviewing metadata may be a valuable way to expand discovery and investigation during litigation, as essentially every digital file may contain useful metadata. With that said, it should be remembered that metadata may be removed or altered. For example, many social media platforms, already notorious for resisting subpoenas, remove metadata associated with users’ posts for obvious privacy and safety reasons. For different reasons, many law firms’ IT systems automatically scrub metadata from email attachments. Regardless, for lawyers who do not already incorporate this into their practice, metadata-related discovery can be an inexpensive and worthwhile way to better serve clients. |||

---

TRAVIS VEST is an associate with K&L Gates in Nashville and is a member of the Construction and Infrastructure practice group. He received his law degree from the University of Tennessee College of Law (now Winston College of Law).

---

NOTE

1. See CNS Gas Co. LLC v. Miller Petroleum Inc., No. E2009-00226-COA-R3-CV, 2011 WL 1849082 (Tenn. Ct. App. May 11, 2011).