Start with the right question
Two files with the same visible content may have different timestamps because one was downloaded or converted. A metadata review should start with a specific question: when was this copy created, which device produced it, or has this exact file changed since preservation?
Work through the checks
Name the field precisely
Distinguish filesystem creation time, modification time, embedded capture time, and export time. Record the tool used to view the field. Similar labels can describe different events on different systems.
Document transformations
List downloads, email attachments, compression, editing, and format conversions. These can affect metadata or create new files. Do not compare dates across copies without understanding how those copies were produced.
Use integrity checks carefully
A recorded hash can support comparison of file contents over time. It does not establish that the original content was truthful, that a named person created it, or that the file came from a particular event.
Keep interpretation separate
Store observed values separately from your explanation. If a field is missing or inconsistent, record the uncertainty. Ask a qualified specialist to assess disputed technical conclusions rather than selecting the most convenient timestamp.
A record you can use
- File and copy identifier
- Metadata field name
- Observed value and time zone
- Tool and inspection date
- Transformation or uncertainty
Keep this record locally. Use document references rather than publishing account numbers or other people's personal details. An empty field means the information is still missing; it should not be filled with an AI guess.
Worked example
A fictional photograph taken in May is downloaded from email in July. The computer shows a July creation date for the downloaded copy, while embedded capture information shows May. The record preserves both values and explains their different meanings instead of accusing someone of altering the photograph.
This example is fictional and illustrates the method, not a real case result.
Limits and next steps
Metadata can be absent, changed, or misleading. Do not modify original files simply to inspect them, and do not upload private evidence to an unknown metadata website. Technical authenticity and legal admissibility are separate questions.
Provide the original file, collection notes, and the precise question to a suitable reviewer. Keep any technical report linked to the file version it actually examined.