Week 5 - Metadata Flashcards
What information does metadata include?
Data about the file itself:
File size, permissions, attributes, owner, time created, last modified and last accessed.
What are examples of temporal metadata?
Time created
Time last modified
Time last accessed
What is temporal metadata?
Data that is part of a files metadata that includes timestamps to indicate when a given event took place.
Why is temporal metadata useful?
Because it can tell us the exact times that a file was created, or last accessed etc. and can allow for investigation into the timeline of events on a file.
How do we access temporal metadata?
By using specific software tools to extract and organise timestamp information.
What can software tools that extract timestamp information do on a file system level?
It can organise and allow for browsing of the events in a file system along a time axis. This allows for a timeline recreation of the events.
What is Timeline analysis?
The investigation and analysis of the timeline of events on a file or file system.
Give an example of a tool that has timeline analysis tools?
Autopsy.
It includes a timeline extraction and display tool.
What is application metadata?
Extra metadata that can be stored, depending on the application used to create the file. Different applications store extra information that helps with processes.
E.g. MS Word stores extra metadata on the Author, Document statistics and Length of time edited.
What are some examples of application metadata?
MS Word stores:
Author
Document statistics
Length of time edited
Digital Images:
EXIF (Exchangeable Image File format) data (Data found in the header of the image file, that contains data about the image)
What can EXIF data include?
Width and Height of image
Pixel measurements
RGB colouring
camera information
What can EXIF data include?
Width and Height of image Pixel measurements RGB colouring camera information Time taken (Can be different from time created)
