An internal spreadsheet was leaked and posted on a public forum. Investigators want to identify which account created the file and when it was last modified, without relying on the forum poster's claims. What should the investigators examine first?
Select an answer to reveal the explanation.
Short Explanation
Every office document carries a little luggage tag you can't see in normal view, and it often names who made it and when it was last touched. That tag is metadata, and it travels with the leaked copy. The trap is chasing network evidence when the file itself is already telling you its history.
Full Explanation
Metadata is data about data, and office documents typically embed fields such as author, organization, creation timestamp, last-modified-by, and last-saved time. Because those fields travel inside the file, the leaked copy itself can be examined to see which account created it and when it last changed, then compared with the file server's audit records for the original. Email messages carry similar metadata in their headers, which is why metadata is treated as its own log and trace data type. NetFlow records from a hosting provider would be outside the organization's control and would only show traffic volumes between addresses; they cannot identify the document's author. A vulnerability scan report lists weaknesses on the file server, which might explain how a breach was possible but does not identify who created or edited this file. A perimeter packet capture from the posting window shows traffic to the forum, and the posting may not even have come from the corporate network, so it does not answer the authorship question. Exam caveat: metadata can be stripped or forged, so it should be corroborated with server-side access logs rather than treated as proof on its own. Operational check: hash the leaked copy, extract its metadata with a forensic tool, and compare author and timestamps to the file server's audit trail.