Suppose I have received a file (doesn't matter what it is - document, image, video, audio, etc). I know that the operating system and also programs that create the file like Office, and even hardware like digital cameras, etc. store a lot of metadata in the file.
Some of these files like MS Office contain some of the metadata in the file itself, while others it seems that Windows "knows" metadata about the file that is not contained in the file. Eg. I create a notepad document and it knows creation date, last access, etc.
I understand that some of this information is kept in the file system itself, but there are many things that I don't see where they are kept.
I have three questions:
- What are the different places that metadata is stored about a file?
- Is there a free/open source tool that can extract metadata from basically any file you give it (like VLC plays basically any media file)?
- Suppose I am doing a forensic analysis of a file, what are the steps I should follow to make sure I get maximum information about the file (especially from metadata)?