Metadata as evidence: how agentic AI helps lawyers authenticate digital proof

Something has shifted in the conversations we have with law firms across Europe. The questions used to be about finding the right clause in a contract or summarising a lengthy judgment. Now, with increasing frequency, the questions are about trust. Can this document be trusted? Was this photo really taken where the other party claims? Is this video even real?

These are not abstract concerns. In a world where generative AI can produce convincing fake images in seconds and anyone can alter a PDF's visible date without touching its creation metadata, the ability to verify digital evidence has become a core legal skill. And at the heart of that verification lies something most people never think about: metadata.

This article explores what metadata is, why it matters more than ever in an era of deepfakes and digital manipulation, and how agentic AI makes forensic metadata analysis practical for any law firm, not just those with dedicated digital forensics departments.

What metadata is and why lawyers should care

Metadata is, quite simply, data about data. It is the information that devices and software record automatically, without the user doing anything deliberate. When you take a photograph on your phone, the image file does not just contain the pixels you see. It also stores the exact time the photo was taken, the make and model of your device, the software version and, if location services were enabled, the precise GPS coordinates of where you were standing.

The same principle applies across every type of digital file. Word documents and spreadsheets record author names, revision histories, print times, and sometimes even deleted content that still lingers in the file structure. Emails carry full routing information showing which servers the message passed through, the IP addresses of sender and recipient, and exact timestamps down to the second. PDFs reveal which software created them, when they were last modified, and whether pages have been added or removed. Even chat messages and screenshots contain device identifiers and timestamps that can establish where and when a message was sent.

For lawyers, metadata is valuable precisely because it is objective, machine-generated evidence. Witness statements are subjective. Documents can be forged. But metadata is considerably harder to manipulate. And when someone does tamper with it, the tampering itself often leaves fresh traces behind.

The deepfake challenge: when seeing is no longer believing

One development has made metadata analysis more urgent than perhaps any other: the rise of deepfakes. With modern generative AI tools, it has become remarkably straightforward to produce convincing fake photographs, videos, and even audio recordings. The implications for legal practice are significant, and they cut both ways.

On one side, fabricating false evidence has never been easier. A photograph of property damage that never occurred, a video recording of a meeting that never took place, an audio clip of words that were never spoken. The technology to create these now sits on any laptop. Lawyers can no longer simply assume that visual or audio evidence is genuine.

On the other side, there is what commentators have termed the "liar's dividend." This is the troubling inverse effect where a party challenges perfectly authentic evidence by simply claiming it is a deepfake. If anything could be fake, everything becomes suspect. That uncertainty undermines the value of legitimate digital proof.

Metadata offers a powerful antidote to both problems. A deepfake will typically carry different metadata from authentic material. The creation software will differ, EXIF data will be absent or inconsistent, the editing history will show anomalies, and the coherence between location, time and device will not hold up to scrutiny. Forensic metadata analysis can therefore both unmask deepfakes and substantiate the authenticity of genuine evidence.

Regulators are catching up with this reality. The UK's Deepfake Detection Framework, announced in February 2026 in partnership with Microsoft, establishes standardised benchmarks for tools that identify AI-generated content. The EU AI Act, taking effect from August 2026, will require providers of AI systems to make deepfakes recognisable through watermarks or metadata marking using standards such as C2PA. Together, these frameworks reinforce the expectation that authentic material should carry verifiable metadata, making its absence or inconsistency all the more telling.

The questions we hear from law firms

To give a sense of just how broad the demand has become, here are some of the questions we received from law firms over the past year.

"Can you verify whether this contract was actually drafted on the date it claims?"

A solicitor in a civil dispute suspected the opposing party had backdated an agreement. Metadata analysis can reveal when a file was genuinely created, when it was last edited, and which software was used. The date printed on the document itself tells you nothing about when it was actually produced.

"We have thousands of emails in this case file. Can AI find patterns in them?"

During an internal investigation into suspected fraud, a firm needed to work through a vast volume of email correspondence. Doing this manually would take weeks. Forensic AI can analyse the metadata across all of those emails to map who communicated with whom, when, how frequently, and whether there are unusual patterns. Think of messages sent in the middle of the night or forwarded to external addresses.

"Can the AI confirm these photographs were genuinely taken at that location, and that they are not AI-generated?"

In an employment law matter, photographs had been submitted as evidence. The question was not only whether they were taken where and when the party claimed, but whether they were real photographs at all. Metadata in photographs contains GPS coordinates, timestamps and camera information that can objectively confirm or refute the claimed origin, while AI-generated images typically lack consistent metadata or show metadata from generation software rather than a camera.

"Documents have been deleted from the server. Can you establish what was in them?"

In a case involving a suspected breach of a non-compete clause, a former employee had deleted files. Metadata analysis of the server and remaining files can reconstruct which files existed, when they were opened, copied or deleted. In some cases it is even possible to recover content from backups or temporary files.

These are not hypothetical scenarios. They are questions from the daily practice of lawyers who need to deploy or challenge digital evidence.

How courts treat metadata: established precedent

Courts have consistently treated metadata as admissible and probative evidence, and several cases from the United Kingdom and beyond illustrate just how decisive it can be.

In Kairos Shipping Ltd v Enka & Co LLC [2016] EWHC 2412, the Admiralty Court examined whether the bulk carrier Atlantik Confidence had been deliberately sunk by her owners to claim on the insurance. Photographs of the vessel were central to the dispute, but the shipowner withheld the EXIF timestamp metadata until day eight of the trial. When those timestamps were finally disclosed, the naval architects instructed by the insurers had to reconsider their analysis in light of the new information. The judge found that the late and reluctant disclosure of metadata undermined the credibility of the shipowner's witnesses. The case is a striking example of how metadata that a party tries to suppress can end up being the very evidence that unravels their position.

Beyond the courtroom, metadata authentication is also gaining ground as a tool for documenting human rights violations. eyeWitness to Atrocities, a UK-based initiative launched by the International Bar Association, has developed a mobile application that automatically captures and preserves metadata, including GPS coordinates, timestamps and surrounding network information, at the moment a photograph or video is recorded. That metadata is then cryptographically sealed so it cannot be altered after the fact. The app has been used to submit over 90,000 authenticated images and videos to the International Criminal Court, the United Nations and European war crimes investigation units. It demonstrates that when metadata is captured properly, it can transform a simple photograph into courtroom-ready evidence with a verifiable chain of provenance.

Internationally, metadata has proven decisive in high-profile criminal investigations as well. The hacker Higinio Ochoa, operating under the alias 'w0rmer', posted a provocative photograph online directed at the FBI. The EXIF data in that photograph contained GPS coordinates pointing directly to his girlfriend's home address. He was identified within hours and arrested shortly afterwards. When John McAfee was on the run in 2012, a journalist published a photograph from an exclusive interview. The EXIF metadata revealed McAfee's exact location in Guatemala, a mistake that ultimately cost him his hiding place.

These cases demonstrate that metadata, information most people do not even know exists, can constitute decisive evidence in proceedings ranging from commercial shipping disputes to international war crimes prosecutions.

Why agentic AI changes the equation

Manually checking metadata across thousands of files is, in practical terms, impossible. A forensic expert can examine a single file thoroughly, but when a case file contains ten thousand documents, manual analysis simply cannot keep pace.

At Andri.ai, we have integrated forensic AI capabilities into our agentic AI platform. This means the same AI that analyses contracts and conducts legal research can also extract and analyse metadata. At scale, systematically, and with an understanding of legal context.

In practice, our agentic AI processes thousands of files and systematically extracts all relevant metadata, from EXIF data and authorship information to editing histories and routing details. It detects anomalies: a document that purports to be from January but carries creation metadata from March, a photograph supposedly taken at the office but with GPS data from another city, or editing timestamps that do not align with the narrative a party has presented. From metadata across hundreds of files, it constructs detailed chronologies of who did what and when, complete with locations and devices. It flags where metadata has been removed, altered or is inconsistent with the claimed provenance of a file. That includes patterns suggesting AI-generated or manipulated media. All findings are presented in a structured report that the lawyer can verify directly and use in proceedings.

The difference from traditional forensic tools is that agentic AI does not merely extract data. It interprets it. The AI understands legal context: it recognises that a backdated document in a fraud case carries different weight from a version discrepancy in a contract negotiation. And it can distinguish between metadata patterns that suggest a deepfake and metadata that positively confirms the authenticity of genuine material.

Metadata analysis across practice areas

Many lawyers associate metadata primarily with criminal law, but its applications extend far beyond that. In corporate law, metadata can establish whether board resolutions were genuinely adopted on the claimed date, providing clarity in liability disputes. In employment law, it can demonstrate that an employee copied confidential business information, because metadata from USB transfers and file modifications reconstructs precisely what happened and when.

In intellectual property disputes, creation dates in metadata can prove who produced a design first, establishing priority in ownership claims. In property law, EXIF data provides certainty in disputes over defects by verifying whether inspection reports or photographs predate or postdate a particular event. And in data protection law, metadata analysis can trace the chain of personal data transfers during a breach investigation, reconstructing exactly where sensitive information travelled and when.

From hidden data to courtroom evidence

The growing number of questions we receive from law firms confirms what we have observed for some time: digital evidence is becoming more important with every passing year, metadata is an essential part of that picture, and the rise of deepfakes makes metadata verification more urgent than ever. Not as a niche technique for forensic specialists, but as a practical tool for every lawyer who works with digital files. And at this point, that is everyone.

The combination of forensic expertise and agentic AI makes it possible, for the first time, to deploy metadata analysis at the scale that modern legal practice demands. Where previously only large firms with dedicated IT forensics departments could undertake this work, it is now accessible to any practice.

Andri.ai combines agentic AI with forensic investigation capabilities. Our AI agents extract and analyse metadata from thousands of files, reconstruct timelines, identify anomalies, and help verify the authenticity of digital evidence. All of this within secure European infrastructure. If you have a case involving digital evidence, get in touch. We are happy to discuss the possibilities.