Secrets in file metadata

The fastest lead in an investigation is often already inside the file: GPS to six decimal places, a camera serial that ties four "unrelated" images to one body, a document author who is a real employee, a template path containing a corporate share name.

Two things beginners get wrong. Absent metadata is not suspicious — it is the normal state of anything that passed through a social platform. And present metadata is not proof: every tag is a claim written by whatever software touched the file last, and all of it is editable with one command.

Where to look first, given what you have