Metadata
Metadata in eDiscovery is the data about a document rather than the content of it, who created or sent it, when, what it was called, where it was stored, and what it was attached to. Courts distinguish system metadata kept outside the file, application metadata stored inside it, and embedded metadata such as formulas and tracked changes.
Also called: system metadata · application metadata · embedded metadata · metadata fields · document metadata
Updated October 2, 2026
How does metadata work?
Aguilar v. Immigration & Customs Enforcement, 255 F.R.D. 350 (S.D.N.Y. 2008), sorts metadata into three kinds, and the distinction is the one that matters in practice.
System metadata is maintained by the file system or the mail server, outside the document: the file’s name, its path, its size, when it was created, last modified and last accessed, and who owns it. It is often the most useful metadata in a case and the easiest to destroy: copying a file with the wrong tool rewrites the dates, which is one reason forensic collection methods exist.
Application metadata is stored inside the file by the program that made it: author, company, revision number, last-saved-by, print date.
Embedded metadata is content the application holds but does not display: spreadsheet formulas and hidden columns, presentation speaker notes, tracked changes, comments. This is the category that disappears when a document is imaged, and the reason hybrid protocols produce spreadsheets natively.
Processing extracts all three into fields, normalizes dates to a stated time zone, and adds fields of its own: hash value, page count, custodian, attachment range, Bates numbers. Those fields are what travel to the other side in the DAT file.
Rule 34(b)(2)(E)(ii) is the backstop: absent a specified form, ESI must be produced “in a form or forms in which it is ordinarily maintained or in a reasonably usable form or forms.” The Sedona Conference’s Principle 12 puts the point directly: reasonably accessible metadata should be produced so the receiving party can access, search and display the information as the producing party could.
What does metadata look like in practice?
A short excerpt from a protocol’s field exhibit, in the order the fields appear in the DAT:
| Field | Source | Example |
|---|---|---|
| BEGBATES | added at production | APEX-004182 |
| CUSTODIAN | added at collection | Mendez, Jane |
| DATESENT | system / mail store | 2024-03-11 14:22 UTC |
| FROM | application | jmendez@example.com |
| FILENAME | system | Q1_forecast_v4.xlsx |
| MD5HASH | added at processing | cde4b6af524450ee10be6ce8b5b86b00 |
| NATIVELINK | added at production | \NATIVES\APEX-004182.xlsx |
The hash shown is a real MD5 digest of a short test string, included to show the 32-hexadecimal-character form; see hash value.
How does metadata show up on an eDiscovery invoice?
Metadata extraction is part of processing and should not be a line of its own. Where it appears separately it is usually inside a data enrichment fee, the Fee Field Guide’s name for vaguely defined per-GB charges covering normalization, metadata extraction and language identification. Those are standard pipeline steps.
The place metadata does reliably cost money is on the way out. A production requiring a custom field order, a non-standard field name, or a computed field the platform does not export natively can turn each production into project management hours rather than a self-service export.
Ask whether metadata extraction is included in processing, which fields the platform exports by default, and whether a custom field list on export is billed.
Sources
- Aguilar v. Immigration & Customs Enforcement, 255 F.R.D. 350 (S.D.N.Y. 2008).
- Williams v. Sprint/United Management Co., 230 F.R.D. 640 (D. Kan. 2005).
- Fed. R. Civ. P. 34(b)(2)(E)(ii), quoted.
- The Sedona Conference, Principles, Third Edition, Principle 12; and Glossary: eDiscovery & Digital Information Management.
- Fee ranges and documented rates: the Fee Field Guide dataset.
Related terms
DAT file · Load file · ESI protocol · Native production · Processing · Privilege log
eDiscovery at one flat monthly rate
$3,250 a month on a 12-month agreement. No per-user fees and no per-GB hosting charges.
Common questions
What metadata fields are usually produced?
A typical protocol lists between 20 and 30 fields: beginning and ending Bates, attachment range, custodian and all custodians, file name, file extension, file size, author, date created, date last modified, date sent, date received, sender, recipients, copyees, blind copyees, subject or title, message ID, folder path, hash value, page count, confidentiality designation, redaction flag, native link and text link. The exact list is negotiated and belongs in an exhibit to the ESI protocol.
Does TIFF production preserve metadata?
Not in the image: a TIFF is a picture of the page. The metadata travels alongside it, in the DAT load file, as the fields the parties agreed to exchange. That is why the field list matters so much in an imaged production: anything not on the list is not produced, and the receiving party has no way to recover it from the image.
Is metadata itself discoverable?
It is discoverable where it is relevant and proportional, like anything else. Williams v. Sprint/United Management Co., 230 F.R.D. 640 (D. Kan. 2005), held that a party ordinarily should produce electronic documents with the metadata intact unless the party timely objects, the parties agree otherwise, or the court orders otherwise. The practical answer is to settle the field list at the Rule 26(f) conference rather than litigate it after production.