Microsoft Office documents can contain a siginificant amount of data about a file referred to as Metadata. Metadata is stored within the file and the information when analyzed can be very useful in forensic examinations and electronic discovery.

One of the most valuable areas of information is referred to as 'Last 10 Authors'. Last 10 Authors/Locations is an area of a Microsoft Word file that, as it states, stores the last 10 authors and locations for the file.

A common assumption amongst litigation support professionals and attorneys is that last 10 authors will be extracted during an electronic discovery process. In fact, last 10 authors isn't included in the OLE stream metadata and is not extracted by common electronic discovery products or vendors.

What is OLE stream metadata? OLE stream metadata is what is commonly viewed through a metadata viewer or sometimes extracted during electronic discovery and contain fields such as Title, Author, Date Last Printed, Date Last Saved etc. Because the last 10 authors is stored in a different location and not easily accessible this information isn't normally extracted during the electronic discovery process.

Once an attorney realizes what information can be available from last 10 authors and locations they can be elated or very concerned depending on who they are representing. It is of additional concern when attorneys realized their scrubbing software or vendor didn't remove this information.

You may be asking yourself, what's the big deal? How does this affect me? In a recent computer forensic exam we were provided a laptop of the suspect and told that it was the computer they used outside of the office. It was claimed that no other computer was used for work related files.

We were a bit suspicious when we were told the laptop was used whenever the suspect wasn't in the office. Our suspicions were a result of determining the laptop was 5 years old and contained partitions that included DOS and Windows 3.1.

It was the last 10 authors that allowed us to provde that not only had the laptop not been recently used to create, modify or save any work related files last 10 authors also allowed us to identify two other systems the individual had access to that were never produced for the case.

It is important to also understand that the last 10 authors data is not only captured when a user clicks 'save' but Microsoft Word's autosave feature will intermintently save files and store the information in last 10 authors.

There are numerous examples of how the last 10 authors is used to win and defend cases. The savy attorneys and computer forensic examiners review this information when examinig their clients files or those produced by opposing counsel.

It is important to remember that not all metadata scrubbing applications remove the last 10 authors information, nor do most electronic discovery applications extract this content. Programatically, last 10 authors can be difficult to access and even more difficult to overwrite or remove.

Pinpoint Labs has created several applications which help attorneys and computer forensic examiners analyze metadata including the last 10 authors fields. It is important to remember that although many people refer to last 10 authors as metadata is isn't accessible through most electronic discovery, computer forensic and metaviewer utility applications. MetaDiscover from Pinpoint Labs can access as well as scrub the last 10 authors details.