Emails, text messages, digital photos, video and audio recordings, and other digital files typically bear relevance in divorce cases, child custody actions, and other domestic proceedings. The metadata of those electronic files can prove useful as well, even if suspect at times. This article explores the uses and limitations of metadata in domestic proceedings.
Metadata has been defined as “data that provides information about other data.”(1) Data about other data includes the telephone number of the mobile phone sending a text message. For digital files such as word processing documents and spreadsheets, metadata includes information describing the author, creation date, and last edit/access date.(2) An email’s metadata shows the IP address of the device which sent it, among other information.(3)
Broadly speaking, metadata may be used in litigation as an aid to authentication of the digital file to which the metadata belongs. Georgia law imposes a requirement of authentication or identification as a condition precedent to admissibility, through evidence sufficient to support a finding that a matter in question is what its proponent claims.(4) The same rules of authentication apply to documents from electronic sources, the principal issues of which concern identification of a) the computer or other device generating the document/communication, and b) the person who was using the device at the time.(5) Digital files may be authenticated through circumstantial evidence.(6) Among that circumstantial evidence: metadata.
Like its associated digital file, metadata itself must be authenticated in order to admit it.(7) Authentication of metadata merely requires showing that the information is what the party proffering it claims: for instance, that the information constitutes data associated with emails or text messages received by the party.(8) In that respect, a party does not need an expert to authenticate metadata for transmissions received by that party.(9)
As opposed to authentication, a lay person probably cannot testify to the significance of metadata. Expert testimony may be needed instead. For example, an expert may have to explain how metadata can enable tracing of the sender of an email.(10)
Among its uses, metadata may help to establish identities of authors of relevant text messages and emails. For instance, in a stalking protective order case against a former lover, the plaintiff used the sender’s IP address, contained in metadata from known emails previously sent to him by the defendant, to show that harassing emails from an anonymous source originated from the same IP address and computer.(11) IP addresses also can be utilized to show that emails purportedly authored by different individuals actually originated from the same computer, and thus either from the same person using different email addresses or from more than one person in the same abode.(12)
Metadata can establish the dates of creation and editing of electronic files too, where the creation date or the alteration of a file from its original form may be relevant. For example, in a divorce case alleging abuse, where wife supported her claims of domestic violence with digital photographs of bruising caused by husband’s assault, Husband claimed the photos’ metadata established that they were created long after the alleged assault.(13)
Because metadata displays the date and time of creation of a digital file, including video files captured on mobile phones or digital cameras, a party may be able to use metadata from successive video files to show manipulation by the other party. In a case alleging domestic violence, for example, the plaintiff attempted to rely on a video he claimed to have surreptitiously recorded on his cellphone showing violent acts by defendant. The defendant – who asserted that plaintiff had manipulated the video by combining bits of several conversations and incidents – relied on metadata demonstrating that the subject video seemingly (and impossibly) began filming only six seconds after the preceding video of more than one minute in length.(14)
The principal limitation of metadata owes to the relative ease of its manipulation. Methods of manipulation include software programs which alter the content of file data by wiping it with zeros or changing letters to corrupt code.(15) Problematically too, other software programs enable direct alteration of the creation and edit dates of digital files.(16)
The potential for manipulation of metadata often results in conflicting expert testimony at trial. For instance, in a divorce case involving claims of spousal abuse, an expert for the allegedly-abusing husband claimed that metadata from wife’s photographs of bruising showed that the photographs were created long after the alleged acts of assault, while wife’s expert claimed that husband, an IT expert, had lifted the photographs from the parties’ shared iCloud account and manipulated the dates of creation in the photographs’ metadata.(17) In another case, involving an ex-wife’s request to set aside a divorce decree due to husband’s fraudulent concealment of marital assets, the wife’s expert relied on metadata – from a computer disc found in husband’s home – to demonstrate that a file for a treatment for a television idea (the allegedly-concealed asset) had been saved on a date seven years prior to the parties’ divorce. The expert admitted on cross-examination, however, that it would be easy to manipulate the metadata, and he would not be able to detect such manipulation in his analysis.(18)
The potential for manipulation of metadata obviously raises red flags as to its usefulness. Nonetheless, if treated with caution and supported by other corroborating circumstantial evidence, metadata can serve as a helpful aid to authentication. In the words of Georgia’s evidence maven, Professor Milich: “Every form of electronic communication can be ‘spoofed,’ ‘hacked,’ or ‘forged.’ But this does not and can not mean that courts should reject any and all such communications. Indeed the vast majority of these communications are just as they appear to be – quite authentic. The goal is to supply sufficient, nonhearsay evidence as the identity of the source such that a reasonable factfinder could conclude that the evidence is what it is claimed to be.”(19)
(1) https://www.merriam-webster.com/dictionary/metadata (2) New v. State, 327 Ga.App. 87, 755 S.E.2d 568, 574 fn. 12 (2014). (3) See Swearngin v. Rowell, A20A0236 (Ga. Ct. App., June 30, 2020). (4) O.C.G.A. § 24–9–901(a). (5) Pierce v. State, 302 Ga. 389, 395-396 (2)(a), 807 S.E.2d 425 (2017). (6) Id., at 395 (2)(a). (7) Hunt-Carden v. Carden, E2018-00175-COA-R3-CV, 14 (Tenn. Ct. App., March 3, 2020). (8) Id. (9) Id. (10) Id., at fn. 4. (11) Swearngin, supra. (12) See, e.g., Ensing v. Ensing, 12591- VCS, 22 (Del. Ch. Ct., March 6, 2017). (13) Carden, supra, at 14(1). (14) Gupta v. Kumar, A147524 and A151983, 9 fn.6 (Cal. Ct. App., November 30, 2018). (15) See New, supra, 755 S.E.2d at 573. (16) See, e.g., https://bulkfilechanger.soft112.com. (17) Carden, supra, at 14. (18) Douthit v. Jones, B293641, 2-3 (Cal. Ct. App., April 7, 2020). (19) Pierce, supra, 302 Ga. at 396 (2)(a), quoting Paul S. Milich, Georgia Rules of Evidence § 7:6, at 194 (2017–2018).