31 Dec What Metadata Can and Can’t Prove: Timestamps, Timelines and Phone Evidence
Metadata gets talked about in court like it’s a lie detector. Somebody says “the metadata shows,” and the room nods.
Metadata is data about data: when a file was created, which device made a photo, when a message was logged. It can answer when, where, and sometimes how. It never answers why, and it’s wrong more often than people think. Here’s what it can carry, where it breaks, and how to tell the difference.
Three kinds of metadata
File system timestamps. Every file on a phone or computer carries times kept by the operating system: when it was modified, accessed, changed, and created. These describe the file.
Embedded metadata. Data written inside the file itself. Photos carry EXIF data: the capture time, the camera or phone model, settings, sometimes GPS coordinates. Documents carry author names, edit times and revision counts.
App and database records. Messaging apps, browsers and the phone’s own logs store events in databases: a message sent, a call placed, a tab opened. Each record has its own time fields, and each field records one specific event. This is what a Cellebrite report is built from.
What metadata can reliably show
When it’s intact, properly collected and correctly read, metadata can establish:
- That a file or record existed at a point in time
- Whether a file was changed after it was created
- Which device or account produced something
- Whether two files are copies of each other or independent
- Whether a sequence of events is consistent or broken
That’s real value. Metadata anchors evidence to something firmer than someone’s memory.
What it can't show
Metadata doesn’t prove:
- Who was holding the device
- Who typed the words
- What anyone intended
- Whether a statement in a message is true
A message can be completely authentic and still misleading. A photo can be original and still be used dishonestly. Metadata confirms structure. It doesn’t confirm meaning.
Where metadata misleads
These are the mistakes I see most, from both sides of a case.
Copying resets the clock. Move a file to a new phone, download it from the cloud or extract it from a backup, and its created time often becomes the moment of the copy. A photo “created” last Tuesday may have been taken three years ago.
Sharing strips it. Many messaging and social platforms strip most of a photo’s embedded metadata when it’s sent or uploaded. A photo pulled from a chat thread may tell you almost nothing about where or when it was taken.
Raw times have to be decoded. Apps store times as numbers counted from a reference date. Unix systems count from January 1, 1970; Apple platforms often count from January 1, 2001. Decode a value against the wrong reference and the date is wrong by decades, or, more dangerously, by a plausible amount.
Time zones. Most records are stored in UTC and converted for display. The tool or the examiner picks the time zone. Get it wrong, or ignore daylight saving, and events shift by hours, which is enough to put someone in the wrong place.
The field records a different event. A timestamp next to a search might mark when a browser tab came into focus, not when the search was typed. That exact mistake became a central fight in the Karen Read trial.
The device clock was wrong. Phones usually sync time from the network, but clocks can be set by hand. Every time the device records inherits its clock’s error.
Can metadata be faked?
Yes. Free tools edit a photo’s EXIF capture time and location in seconds. File timestamps on a computer can be rewritten, a technique examiners call timestomping. A phone’s clock can be set to any date before something is created on it.
What’s hard to fake is consistency. Changing one timestamp is easy. Changing it everywhere it echoes is not: the file system, the embedded data, the app database, the cloud backup, the other person’s phone, the carrier’s records. A forger has to control every one of those and anticipate which ones someone will check. Most don’t. The fake holds up in isolation and falls apart the moment it’s compared with anything else.
That’s why single timestamps should never carry a case, and why timelines matter.
Timelines: where metadata becomes evidence
A timeline isn’t a stack of screenshots in date order. It’s a reconstruction that lines up every relevant record across devices and platforms (messages, calls, locations, posts, deletions, app activity) so you can see how events relate to each other, not just that they happened.
Three things show up on a timeline that never show up in a single artifact:
Sequence. A message that looks threatening on its own can be a reply to provocation. A post that looks harmless can land an hour after a private fight. Meaning changes when order is restored. Cherry-picking works by stripping out what surrounds a message, and a timeline puts it back.
Gaps. Sometimes what matters is what isn’t there: a thread that goes silent at the critical hour, records missing for a stretch of days, a phone that stops logging anything. Gaps that line up with key moments need an explanation.
Contradictions. A photo whose capture time puts someone at home while their phone’s location data puts them across town. A message logged before the device that supposedly sent it was activated. Contradictions between sources are where fakes and errors surface.
Where timelines go wrong:
- Mixing time zones across sources without converting them
- Building from one platform and ignoring the rest
- Treating every timestamp as the same kind of event
- Writing conclusions into the timeline instead of letting the sequence speak
A good timeline describes. The argument comes after.
Questions to ask about any metadata in your case
- Which kind is it: file system, embedded, or database record?
- What event does this specific field record?
- Was the file copied, shared or exported before it was collected?
- Which time zone and which reference date were used to decode it?
- Was the device clock accurate?
- Does any other source, on another device or platform, agree?
- Is anyone drawing intent or authorship from metadata alone?
The takeaway
Metadata doesn’t tell you the truth. It tells you where to look. Used carefully, it keeps everyone’s story honest, including your own client’s. Used carelessly, by either side, it hands the jury a reason to doubt everything else.
If your case turns on a date, a time or a file’s history, start with a TruthScan. It’s a flat-rate review that tells you what your metadata actually supports, and what it doesn’t.