What Is Metadata (eDiscovery)?

Metadata is descriptive information carried alongside a file rather than inside its visible content. The standard metadata definition, data about data, is accurate but incomplete. What makes metadata useful is that it answers questions the document itself cannot: a memo shows what was written, while its metadata shows who wrote it, when, on what system, and whether it was altered afterward.

Courts have described metadata as embedded information recording the history, tracking, and management of an electronic document.

Metadata attaches to every form of electronically stored information, including email, office documents, chat messages, and files pulled from cloud platforms. Some of it is visible to the user, such as a tracked change or a comment. Most of it is not, which is what makes metadata both evidence and a hazard.

What Are the Types of Metadata?

Courts recognize three types of metadata. In Aguilar v. Immigration and Customs Enforcement, a federal court set out the categories that eDiscovery practitioners now apply.

1. System Metadata: Information generated by the operating system or file system, including file name, size, author, and creation, modification, and access dates. It sits outside the file and drives most filtering and sorting.
2. Substantive Metadata: It is also called application metadata. Information created by the software used to make the file, including prior edits, tracked changes, comments, and spreadsheet formulas. It stays embedded when the file is copied or moved.
3. Embedded Metadata: Data entered into a file but not displayed on screen, such as the formula behind a visible spreadsheet value.

Processing platforms generate a fourth layer, sometimes called derived metadata. Hash values, document IDs, and parent-attachment relationships do not originate with the file, but they travel with the record through review and production.

Library and information science uses a different set of categories, descriptive, structural, and administrative. Those terms describe the same underlying concept but are not the framework courts apply in discovery disputes.

How Does Metadata Extraction and Collection Work?

Metadata collection begins at the source. When files are gathered from a custodian's mailbox, laptop, or cloud account, the collection method determines how much survives. Copying files by hand through an operating system overwrites access dates and can reset authorship, which is why defensible collection uses forensic tools that capture the file and its metadata together.

Metadata extraction happens next, during the processing stage of the EDRM. Processing software opens each file, reads its metadata into structured fields, and indexes those fields alongside the extracted text. Those fields are what make deduplication, email threading, and targeted search possible across a full dataset.

Common Metadata Fields in eDiscovery

A standard production field set includes:

• Custodian: the person or system source the file was collected from
• File name, file path, and file size
• Author, date created, date modified, and date last accessed
• Email fields: from, to, cc, bcc, subject, date sent, and date received
• Hash value: a fixed-length value calculated from the file's contents

Hash values serve a distinct role. Any change to a file produces a different hash, which makes it the standard mechanism for verifying that evidence has not been altered.

Preservation runs alongside all of this. Once a duty to preserve is attached, it reaches the metadata as well as the file, because a document with reset dates or stripped authorship carries far less evidentiary weight than the same document collected intact.

Why Does Metadata Matter in eDiscovery?

Metadata is discoverable when it is relevant to a claim or defense and not privileged. Its practical value falls into three areas: authenticating a document, establishing when events occurred, and making large volumes of data searchable and sortable.

Form of production determines whether metadata reaches the other side. Under Federal Rule of Civil Procedure 34(b)(1)(C), a requesting party may specify the form. Absent that, Rule 34(b)(2)(E)(ii) requires production in the form the information is ordinarily maintained or in a reasonably usable form. In Blevins-Clark v. Beacon Communities, a court held that native files produced as PDFs stripped of metadata did not meet that standard and ordered re-production.

Image productions handle this differently. When files are converted to TIFF or PDF, the metadata travels separately in a load file, a delimited text file mapping each field to its corresponding document. The image itself carries no native metadata, which is also why OCR is needed to make those pages searchable.

Timing is the trap practitioners hit most often. Courts have ordered metadata produced where it was specifically requested in the initial document request and the producing party had not yet produced the documents in any form. A request made after production has already occurred in another form is considerably weaker.

Key Takeaways

• Metadata is data that describes other data, recording a file's creation, handling, and structure rather than its content.
• Courts recognize three types of metadata: system, substantive (application), and embedded.
• Metadata collection method determines what survives; metadata extraction during processing turns it into searchable fields.
• Standard metadata fields include custodian, dates, file path, email header fields, and hash value.
• Metadata is discoverable when relevant, but it generally must be requested before production occurs in another form.

Venio eDiscovery extracts and indexes metadata fields during processing, keeping custodian, date, and hash values consistent from collection through production. Book a demo to see it on your own data.

‍

‍

Frequently Asked Questions

What is metadata in simple terms?

‍Metadata is data that describes other data. For a file, it records details such as who created it, when it was last modified, and where it was stored, rather than what the file contains.

What are the three types of metadata?

‍System metadata, substantive or application metadata, and embedded metadata. System metadata is generated by the operating system, substantive metadata by the application used to create the file, and embedded metadata is entered into a file but not displayed on screen.

Is metadata discoverable?

‍Yes, when it is relevant to a claim or defense and not privileged. Courts have generally ordered metadata produced where it was specifically requested in the initial document request and the documents had not already been produced in another form.

How is metadata lost during collection?

‍Copying files through an operating system, converting them out of native format, or producing them as images without a load file can overwrite or strip metadata. Forensic collection tools capture the file and its metadata together to prevent this.

‍