Metadata is "data about data" and it can be exceptionally useful in showing who did what with a file. Analysing the metadata from a series of files can establish a timeline of the user activity. File metadata can establish information such as the original author, who last saved the file, who last printed it, who is responsible for its presence in its current location as well as several date and time stamps associated with user activity.

This type of analysis can resolve Intellectual Property theft cases by showing where a questioned file originally came from.

However, metadata should be considered 'in the round' with a variety of other data sources in order not to arrive at erroneous conclusions and its interpretation needs skill, care and experience.