- [Instructor] Throughout the course,
we've seen a few different ways that information could be
leaked accidentally through various kinds of metadata,
and consequently,
we've seen how we can discover information in metadata
that might not have been intended for us to know.
Embedded metadata while very useful,
can contain sensitive data like geolocation information
and custom or internal tags that clients
and others shouldn't see.
So this kind of sensitive information should be carefully
removed or stripped before sharing files outside
of a secure perimeter.
We've also seen that metadata can be maliciously falsified,
or simply be incorrect,
and that it shouldn't be trusted on critically.
Metadata stored by file systems can also present a risk
of information loss or exposure in a variety of ways.
Copying files secured with an ACL to a file system
without ACL support, for example,
can expose those files to the effects
of that security control not being applied.
Unauthorized users could access files and authorized users
could simply alter or delete a file that was intended to be
protected from those changes.
Sometimes our systems and tools will warn us if metadata
or extended attributes are not going to be copied
to a destination, but not always.
So it's up to us to be aware of how those tools, systems,
and file systems interact,
and we should always double check our results.
If we're not careful about how metadata is treated,
we could lose information that we didn't intend to lose.
For getting a specific option when using
a file copying tool or doing a bit
of overly aggressive digital housekeeping
could sweep away categories,
notes, and other information stored as metadata.
We might forget that we have a folder somewhere flagged
as hidden, or we could drive ourselves up
a wall troubleshooting an issue
that relates to otherwise semi-invisible characteristics
like ACLs or immutability if we don't know where to look.
While metadata can be easy to overlook,
it's really important that we treat it just as seriously
as we do the data it describes.
If you're interested in a deeper dive
about security forensics,
be sure to check out the course Operating Systems Forensics
here on LinkedIn Learning.