Many computer forensic examiners and attorneys are aware that metadata is valuable to many corporate cases. Metadata is the information stored within Microsoft Office and other files that can tell when files were created, edited, printed, stored and dozens of other facts.
One of the most valuable areas of information is referred to as ‘Last 10 Authors’. Last 10 Authors/Locations is an area of a Microsoft Word file that, as it states, stores the last 10 authors and locations for the file.
A common assumption amongst litigation support professionals and attorneys is that last 10 authors will be extracted during an electronic discovery process. In fact, last 10 authors isn’t included in the OLE stream metadata and is not extracted by common electronic discovery products or vendors.
OLE stream metadata is what is visibile and often extracted through computer forensics, electronic discovery and several free utilities. Microsoft provides a dll library to allow software developers to easily access dozens of metadata fields (i.e. Title, Author, Date Last Printed, Date Last Saved etc.), however, the dll and other metadata libraries (as well as scrubbing utilities) don’t provide access to the last 10 authors information.
