Sunday, February 16, 2014

Cyberbullying Investigations- Metadata Part 5

Metadata is information stored with digital content or communications. There are three basic categories of metadata:  substantive, system, and embedded.  Substantive metadata is metadata created by the application used by the user, and is usually embedded within the application itself.  This category of metadata often shows information about the modification or editing of a document or file. When cyberbullying occurs and there are allegations that the document or image used in the cyberbullying had been doctored or changed substantive metadata could allow the investigator to discover whether files have been altered by another party.

  System metadata is created by the user, the system or network being used.  This metadata includes programmed information about the author, technical information about the author’s device, possibly the location, and the date and time of the publishing or modification of information.  This metadata will help identify the device used in creating the content, and depending on the accuracy of any programmed settings, the owner, date, location and time the content was created. It can often help determine the “ground zero” of a cyberbullying, harassment or sexting campaign.


Embedded metadata consists of the content, data, text, or other information that a user inputs his or herself, but which is not typically visible when viewing the native file.  Examples of this include spreadsheet formulas, and internally or externally linked files, such as hyperlinks or sound files. This is often used to help mask the real cyberbullying. Linking an innocent-appearing image to a rumor-mongering Facebook post or nastier manipulated images makes it easier to launch a cyberbullying public campaign without being obvious to school authorities or other adults.