An area of a Microsoft Word file commonly referred to as metadata is 'Last 10 Authors'. Last 10 authors/locations and the data captured can be valuable in a computer forensic examination or electronic discovery project.



Many computer examiners and attorneys have found out the hard way that last 10 authors isn't normally extracted or displayed when using several popular computer forensic or electronic discovery processing software.

What is OLE stream metadata? OLE stream metadata is what is commonly viewed through a metadata viewer or sometimes extracted during electronic discovery and contain fields such as Title, Author, Date Last Printed, Date Last Saved etc. Because the last 10 authors is stored in a different location and not easily accessible this information isn't normally extracted during the electronic discovery process.

Many scrubbing applications don't remove the data contained in the last 10 authors. Because this informaiton is not included in the standard metadata fields it is often forgotten and becomes available for others to view and possibly use to their advantage.

In a recent computer examination I was examining a USB drive which contained the current working files of the suspect. We were also provided access to a laptop which the suspect claimed was the only computer used in addition to the office computer.

We were a bit suspicious when we were told the laptop was used whenever the suspect wasn't in the office. Our suspicions were a result of determining the laptop was 5 years old and contained partitions that included DOS and Windows 3.1.

We were able to confirm our suspicions on this case using the last 10 author data from several Microsoft Word files on the USB drive that the suspect used to store their working files. We were also able to identify two other computers that the suspect was using to create and edit files which were never examined or produced in the case.

In addition to saving the location of the last 10 authors and locations when the user saves the file, it is also possible that the last 10 authors was updated during an autosave process. Microsoft Word will often autosave the contents of a file while the users is working on a document. Autosave will store this information in the background as the user works.

There are dozens of examples like this where last 10 authors 'metadata' can be used to help with a conviction or judgement. Informaiton can work for or against an individual and their legal representation. When it is determined that metadata is priveledge information or for any reason should be excluded, don't forget about last 10 authors.

When selecting a vendor or software to scrub documents it is important to insure that the last 10 authors is removed during scrubbing. Not all vendors or software applications will identify and remove the last 10 authors data.

In summary, last 10 authors is referred to as metadata, however, it isn't accessible through most computer forensic software or electronic discovery application. Last 10 authors data can be viewed and scrubbed using applications from Pinpoint Labs (Pinpoint MetaViewer, MetaDiscover). There are a couple other applications, however, the applications from Pinpoint Labs can access and scrub the data without altering the file system timestamps and is significantly quicker than other applications reviewed.