Would Metadata Cleaning Spoil Your Evidence?
In Dr. Ball’s blog, he smartly notes: “Application metadata resides within the file and moves with the file, not changing unless the contents of the file are altered. System metadata resides outside the file and can be altered without impacting the contents of the file. Hashing the file hashes its contents, not information about the file. That is, you only hash what’s stored inside the file, not its system metadata.” He also notes other points about how any hashing, and metadata cleaning, WOULD change the file.
