Purpose and when to use it
Use metadata to identify sources, connect records, investigate transformations, or interpret times. Treat each consequential interpretation as a version-specific claim that can be checked against raw data.
Evidence required
Work with original objects, schema or format documentation, raw field values, application versions, parser output, and known-condition controls. Keep encoded values before converting them.
Principles and procedure
- Identify the format and schema rather than guessing from an extension.
- Retain raw values, nulls, units, encoding, and record identifiers.
- Determine the event and clock represented by each relevant timestamp; document conversion rules.
- Test important field meanings using official documentation or controlled observations in the relevant environment.
What to document
Record tool and parser versions, unsupported fields, conversion errors, timezone assumptions, and examples linked to evidence IDs. Keep a derived table traceable to original records.
Failure modes
A parser can silently misread a schema, truncate a timestamp, or omit unsupported records. File-copy times can be confused with content-creation times, while an editable generator label can be mistaken for verified origin.
Limits on the conclusion
Metadata can be altered or lost and may describe processing rather than creation. Correctly decoding a field does not guarantee that the source recorded a truthful or complete event.
Independent checks and corroboration
Compare consequential metadata with content, independent system records, and earlier versions. Test disagreements without forcing all clocks or fields into one preferred story.
How to report the result
Describe both the raw observation and the interpreted meaning. Where semantics remain unverified, name the field and value without assigning a stronger event description.
Related glossary terms
Which event does this timestamp describe?
Retain the raw value, field name, format, timezone context, and source version. Compare controlled creation, import, edit, and synchronization actions where authorized. Check independent records for the event the field is being used to support.
If testing shows the value tracks local import, report that meaning rather than calling it original creation time. When field semantics are unknown, the observation remains useful but its event interpretation is unresolved.
Sources & further reading
Source verification checks the official publication and its scope. It is separate from independent technical review of this reference page.
- NIST SP 800-86: Guide to Integrating Forensic Techniques into Incident Response
IT-oriented forensic process and sources; published 2006. It is not a complete investigative procedure or legal advice.
- SQLite: Write-Ahead Logging
Database, WAL, checkpoint, and associated shared-memory behavior. General SQLite behavior is not proof of an AI application’s storage design.
Canonical reference: https://syntheticforensics.org/methods/metadata/
Report a technical correction