Cyberstudy
PDF p.324 In progress

Metadata

Open PDF at p.324 22 flashcards

Summary

PDF p.324

Metadata refers to the properties of data created by an application, stored on media, or transmitted over a network. It helps establish timelines and contains other types of evidence useful in investigations.

In plain words

Supplementary — not from your PDF

Metadata is data about data, and it's valuable for building timelines. File metadata includes created, accessed and modified times, attributes, ACLs and extended attributes such as author. Photos on social media may carry location. Web metadata is in HTTP headers, including cookies. Email headers record each server hop (MUA → MDA → MTA) and can be viewed in the mail client's 'show original' option or parsed with tools such as Message Analyzer.

Detailed explanation

PDF p.324

File Metadata

  • Attributes: Tracks file creation, access, and modification times.
  • Security Attributes: Read-only, hidden, or system file status.
  • ACLs: Permissions attached to a file.
  • Extended Attributes: Author, copyright information, tags for indexing/searching.
  • Social Media: Metadata can reveal location and time when uploaded with media.

Web Metadata

  • Headers: Returned by web servers and included in client requests.
  • Authorization: Transmitted via cookies.
  • Data Type: Headers describe the type of data returned (text, binary).
  • Inspection: Headers can be inspected using web browser tools and logged by web servers.

Email Metadata

  • Internet Header: Contains recipient and sender addresses, server handling details.
  • Creation: Mail user agent (MUA) creates initial header, forwards to mail delivery agent (MDA).
  • Transmission: MDA checks sender authorization, adds/amends header, transmits to message transfer agent (MTA).
  • Routing: MTA routes message, adding information to the header.
  • Viewing Headers: Use message properties/options/source command in mail clients.
  • Parsing Tools: Tools like Message Analyzer (part of Microsoft Remote Connectivity Analyzer) parse and display headers in a structured format.

Important terms

taken from the text above
Security Attributes
Read-only, hidden, or system file status.
ACLs
Permissions attached to a file.
Extended Attributes
Author, copyright information, tags for indexing/searching.
Social Media
Metadata can reveal location and time when uploaded with media.
Headers
Returned by web servers and included in client requests.
Authorization
Transmitted via cookies.
Data Type
Headers describe the type of data returned (text, binary).
Inspection
Headers can be inspected using web browser tools and logged by web servers.
Internet Header
Contains recipient and sender addresses, server handling details.
Creation
Mail user agent (MUA) creates initial header, forwards to mail delivery agent (MDA).
Transmission
MDA checks sender authorization, adds/amends header, transmits to message transfer agent (MTA).
Routing
MTA routes message, adding information to the header.
Viewing Headers
Use message properties/options/source command in mail clients.
Parsing Tools
Tools like Message Analyzer (part of Microsoft Remote Connectivity Analyzer) parse and display headers in a structured format.
MUA Mail user agent

Examples & real-world scenarios

Supplementary — not from your PDF
  • Using file modified times to build a timeline.
  • Reading email headers to trace a phishing message's servers.
  • Checking photo metadata for location.

Scenario

A suspicious email claims to come from the CEO. Its headers show it came through an unknown external server and failed authentication checks, confirming it was spoofed.

Common mistakes

Supplementary — not from your PDF
  • Trusting the visible 'From' name without checking the headers.
  • Changing file timestamps by opening evidence files directly.

Practical skills

Supplementary — not from your PDF
  • Read an email header to trace its path.

What I should remember

Key Points PDF p.324
  • File Metadata
    • Attributes: Creation, access, modification times.
    • Security: Read-only, hidden, system file status.
    • ACLs: Permissions.
    • Extended Attributes: Author, copyright, tags.
    • Social Media: Reveals location and time.
  • Web Metadata
    • Headers: Server returns, client includes.
    • Authorization: Cookies.
    • Data Type: Text, binary.
    • Inspection: Browser tools, server logs.
  • Email Metadata
    • Internet Header: Recipient, sender, server details.
    • Creation: MUA creates, MDA forwards.
    • Transmission: MDA checks, transmits to MTA.
    • Routing: MTA adds information.
    • Viewing: Mail client commands.
    • Parsing Tools: Message Analyzer.