Metadata and timelines

4 min read

Files carry more than their contents. EXIF in photos records the camera, the software, timestamps, and often GPS coordinates. Documents embed authors, edit history, and template paths. This metadata answers who, when, and where long after the visible content has been sanitised — and it is where a surprising number of forensics flags hide, because people scrub the picture and forget the tags.

At the system level, forensics is about timelines: filesystem MAC times (modified, accessed, created), log entries, shell history, and memory artifacts, all sorted into one ordered story. The skill is correlation — a file created seconds after a login, a process that spawned a network connection, a deletion that lines up with an alert. The individual facts are ordinary; the order is the evidence.