In digital evidence handling, what does metadata reveal?

• A. Metadata can show who created a file, times, locations, and is part of evidence integrity.
• B. Metadata is irrelevant.
• C. Metadata can show the suspect's intent.
• D. Metadata is removed after transfer.

Answer: (C)

Metadata is the contextual data embedded in digital files that describes their origin, timing, and history. It can reveal who created or last edited a file, when it was created or modified, and where the file originated or where the device was located when it was created (for example, GPS data in photos). This information helps establish the timeline, source, and authenticity of the evidence, and it can support the integrity of the file through details like the software used or embedded version information and, in some cases, hashes or signatures that verify it hasn’t been altered.

So, metadata provides important context about provenance and timing, not information about a suspect’s intent, and it isn’t automatically irrelevant or always removed after transfer.