Metadata and You

Drudge leaked a bunch of Beauchamp documents. I was lucky enough to get them downloaded before they were pulled. And I think I know why they were pulled.

In a modern law office, you do a lot of what is called “Electronic Data Discovery”. That is where you get your information from the other side in electronic form, instead of paper, especially if it was electronic to start with. You do this because paper doesn’t tell you all the wonderful, wonderful things that electronic files do. That is because electronic files almost always contain metadata, or “data about the data.” In some programs, like Microsoft Word and PDF, this data can be extensive. Any file has creation and modification dates, and Word and Acrobat also embed a system independent creation/modification date piece of metadata in the files.

The Beauchamp documents are three PDFs, entitled 1, 2, and 3. The metadata tells us that all were created on HP devices, probably multifunction copiers. They also tell us when they were created, and that is where the interesting things start to happen. First, these three files were created at two different times. 1&2, the Beauchamp call to TNR, were created on October 12. (Created meaning they were put on the copier and PDFs made.) 3, containing the report information, however, was created August 24, more contemporaneously with the original activity, and none of them appear to have been modified since their creation. (You can fake this data, but most people don’t know how.)

Here’s the fun part. PDF files also contain the time zone settings of the system that created it inside the creation and modification dates. The timezone offset for 1 and 2 is +3 UTC. That, ladies and gentlemen, is likely to be Iraq, Kuwait, or Qatar. Those are the files with the interview. 3, containing the investigation results, is +4 UTC. That would put it in Oman or the U.A.E. This is consistant with these being Army documents. The question is whether or not these came straight from the Army, or if this is how they were transmitted to the law office and leaked from there.

Comments are closed.