Practice area
Document Forensics
Examination of PDF files, Microsoft Office documents, and photographs, often the attachments at the center of an email dispute.
What the analysis answers
- When was this document created, and with what software?
- Was it edited after the date it claims?
- When and with what device was this photograph taken, and was it edited afterward?
- Is this attachment the same file the sender had?
- Does a PDF printout of an email match the original message, and was it changed after it was created?
- What do the document's internal records say about its authors and edits?
What is examined
- Object structure, incremental updates, XMP metadata streams, and the document information dictionary, including PDF printouts of email messages produced as evidence. See email forensics.
- Microsoft Office
- Word, Excel, and PowerPoint files in the legacy binary (Compound File Binary) and the current OOXML formats, including author and revision metadata, internal timestamps, and the traces left by the software that saved them.
- Photographs and images
- JPEG, HEIC, PNG, and other image formats, including Exif, XMP, and IPTC metadata, embedded thumbnails, and the traces left by cameras and editing software.
- Timestamps
- File system timestamps, their resolution, and the timestamps that survive as a file travels as an email attachment.
Related writing
- Address
- 840 Apollo Street, Suite 100
El Segundo, CA 90245