Last 10 Authors – Microsoft Word How To

By Guest

Many computer forensic examiners and attorneys are aware that metadata is valuable to many corporate cases. Metadata is the information stored within Microsoft Office and other files that can tell when files were created, edited, printed, stored and dozens of other facts.

One of the most valuable areas of information is referred to as ‘Last 10 Authors’. Last 10 Authors/Locations is an area of a Microsoft Word file that, as it states, stores the last 10 authors and locations for the file.

A common assumption amongst litigation support professionals and attorneys is that last 10 authors will be extracted during an electronic discovery process. In fact, last 10 authors isn’t included in the OLE stream metadata and is not extracted by common electronic discovery products or vendors.

The reason this information isn’t available during normal metadata extraction processes (OLE stream) is that last 10 authors isn’t stored in the same location as the other OLE metadata. Additionally, the tools provided by Microsoft to extract metadata (which many software developers use) doesn’t include last 10 authors.

Once an attorney realizes what information can be available from last 10 authors and locations they can be elated or very concerned depending on who they are representing. It is of additional concern when attorneys realized their scrubbing software or vendor didn’t remove this information.

We were recently hired to review a couple computer systems and a USB drvie of a corporate employee. We were told that the two computers provided were the only systems that were used by the employee.

We suspected that due to the age of the laptop and that there was very little information on the computer that the suspect provided us with a computer that had been retired and wasn’t in use as stated.

When we reviewed the last 10 authors information on dozens of current working files located on the USB drive we were able to determine that none of the files were created or recently modified on the laptop. In fact, we were able to determine the employee had access to two other systems which had been used to edit the working files.

The last 10 authors provides not only the author but the location of the file. Additionally, the autosave feature in Word can cause the location of a file to be stored even if the user didn’t manually save their documents.

To seasoned computer forensic examiners and attorneys the last 10 authors information is used to support their case or they may insure it is scrubbed before producing documents to opposing counsel.

When selecting a vendor or software to scrub documents it is important to insure that the last 10 authors is removed during scrubbing. Not all vendors or software applications will identify and remove the last 10 authors data.

Pinpoint Labs has created several applications which help attorneys and computer forensic examiners analyze metadata including the last 10 authors fields. It is important to remember that although many people refer to last 10 authors as metadata is isn’t accessible through most electronic discovery, computer forensic and metaviewer utility applications. MetaDiscover from Pinpoint Labs can access as well as scrub the last 10 authors details.

About the author: Jon Rowe is the President of Pinpoint Labs and a Certified Computer Examiner. To learn more about Pinpoint Labs click herePinpoint Labs Website – Computer Forensics Software and Services

Article kindly provided by UberArticles.com

Topics: Uncategorized | No Comments »

Reprint Rights

Comments are closed.