Legal Intelligencer: Metadata Attorneys Are Not Asking for (but Should Be)

The document may be produced with those standard fields, yet the more important evidence could be the version history, which might show that the memo was substantially revised after the employee complained of discrimination.

Likewise, in a trade secret case, counsel may obtain emails and their metadata but fail to request audit logs showing who downloaded files before leaving the company. The strongest evidence may be in those logs, but it remains undiscovered because no one asked for it. The real issue is often not whether metadata was requested, but whether the right metadata was requested.

Part of the problem is that metadata is often discussed as though it consists solely of creation dates, modification dates, and author information. In reality, metadata encompasses a much broader range of information about a document’s history, characteristics and use. Electronic files may contain hundreds or even thousands of metadata fields. For example, email metadata can include information regarding transmission, receipt, forwarding, bcc recipients, and address-book data, while word-processing documents may contain edit histories, comments, formatting information, and other embedded data not visible on the face of the document.

Metadata can reveal information about a document’s origin, authorship, transmission, modification, and use that may not be apparent from the document itself. This broader understanding of metadata illustrates why limiting requests to a handful of standard load-file fields may overlook metadata that is far more significant to the claims and defenses at issue.

As organizations increasingly conduct business through cloud-based collaboration platforms, messaging applications, and enterprise systems, some of the most significant metadata may reside in sources that rarely appear in standard discovery requests, including version histories, audit logs, access records, edit histories, and communication metadata.

Collaboration platforms such as Microsoft SharePoint, Google Workspace and similar systems illustrate this point. When a document is produced in litigation, counsel often receives only the final version of the document. What is frequently missing, however, is metadata showing how the document evolved over time.

Prior versions may reveal significant edits, identify additional custodians, establish when information was added or removed, and provide insight into the decision-making process. In cases involving contract negotiations, employment decisions, or internal investigations, version histories may tell a far different story than the final document ultimately produced.

Version histories can be particularly important because they may be lost when information is exported, converted, or produced in static formats. By the time discovery begins, the metadata that reveals how a document evolved may already be gone unless counsel identifies and preserves it early in the case.

Comments and tracked changes present a similar issue. Although attorneys routinely request final documents, they often fail to specifically address embedded comments, suggestions, and revision histories. These materials can identify individuals involved in drafting, reveal concerns later omitted from the final document, and provide contemporaneous evidence regarding a party’s knowledge or intent. Once documents are exported or converted for production, much of this information may be lost unless it is specifically preserved and requested.

Another frequently overlooked source of metadata is audit log data. Many organizations maintain logs showing when users accessed documents, modified files, downloaded information, or changed permissions. These logs can become particularly important when claims involve alleged document destruction, misuse of confidential information, trade secret disputes, or questions regarding the authenticity of evidence.

In some cases, audit logs provide the only reliable record showing who interacted with a document and when those interactions occurred. They may also identify individuals who never appear as authors, recipients, or custodians in the documents themselves but nevertheless played a significant role in the underlying events.

Communication platforms present a similar issue. Messages from Microsoft Teams, Slack, and similar applications are frequently produced as screenshots, PDFs, or other static images. While those productions may capture the visible content of a communication, they often omit metadata that may show whether a message was edited or deleted, identify all participants in a conversation, establish the precise timing of communications, or place individual messages within the context of a larger conversation thread. As a result, a screenshot may reveal what was ultimately said while hiding important information about the circumstances surrounding the communication.

Metadata can also reveal relationships that are not apparent from reviewing individual documents in isolation. Email and messaging metadata may identify communication patterns among key actors, reveal previously unknown participants in a discussion, and help reconstruct how information moved through an organization.

In some matters, understanding who communicated with whom, when, and how frequently may be as important as the content of the communications themselves. Such information can assist counsel in identifying additional custodians, evaluating witness credibility, and developing more targeted discovery strategies.

As organizations continue to rely upon cloud-based collaboration tools, the gap between the information that attorneys request and the information that actually exists will continue to grow. The Sedona Principles likewise recognize that the “special characteristics” of ESI, including metadata and other non-apparent information, may be pertinent to the form in which ESI should be preserved and produced. See “The Sedona Principles, Third Edition: Best Practices, Recommendations & Principles for Addressing Electronic Document Production,” Principle 12, Comment 12.a, 19 Sedona Conf. J. 169 (2018).

For that reason, counsel should consider metadata issues at the outset of a matter and identify the metadata most likely to prove or disprove the claims at issue, before relevant information is altered, lost, or produced in a form that no longer contains the information necessary to tell the complete story. In many cases, standard metadata fields will be sufficient. In others, version histories, audit logs, collaboration platform metadata, and document revision records may contain some of the most significant evidence in the case.