1. Meaning of Metadata Preservation

Metadata preservation means maintaining the information that describes an electronic record, document, communication, transaction, or digital file so that the record remains authentic, reliable, complete, traceable, and capable of being produced as evidence.

Metadata may include:

• Creation and modification dates
• Author/creator information
• File names and extensions
• File paths and locations
• Access and permission information
• Email sender, recipient, CC and BCC information
• Email transmission dates and times
• Message IDs and headers
• Document version history
• Audit trails
• System-generated timestamps
• IP addresses, where lawfully recorded
• Device identifiers
• Database transaction logs
• User activity logs
• Electronic signatures
• Hash values
• Chain-of-custody information
• Application/system information used to create or modify the record

In an employment or HR environment, metadata can become particularly important when investigating employee misconduct, harassment complaints, payroll disputes, discrimination, termination, whistleblowing, working-time claims, data breaches, or litigation.

2. Why Metadata Preservation Is Important

The substantive document alone may not establish whether it is genuine.

For example, an HR department may produce an email saying:

"The employee was warned about poor performance."

The employee may dispute it.

The metadata may help establish:

• when the email was created;
• who actually sent it;
• whether it was subsequently modified;
• whether attachments were included;
• whether the email existed before the dispute;
• whether another person accessed or altered the document;
• whether the document came from the company's ordinary business system.

Thus, metadata supports the provenance and integrity of electronic evidence.

3. Core Metadata Preservation Requirements

A sound preservation programme should address at least the following.

A. Preserve Original Electronic Records

Organizations should preserve the original electronic record or an appropriately preserved forensic copy, rather than relying exclusively on:

• screenshots;
• printouts;
• manually copied text;
• exported PDFs;
• photographs of screens.

Conversion may eliminate important metadata.

For example:

Original email → PDF

The PDF may preserve the visible text but lose:

• Message-ID;
• routing information;
• server timestamps;
• attachment metadata;
• original headers;
• transmission information.

Therefore, where litigation or investigation is foreseeable, the original electronic source should generally be preserved.

B. Preserve Relevant Metadata

The organization should identify metadata that is relevant to the dispute or investigation.

For HR investigations, this can include:

4. Preservation Must Begin When Litigation or Investigation Is Reasonably Foreseeable

A company should not wait until a court formally orders production.

Once the organization reasonably anticipates:

• litigation;
• labour proceedings;
• regulatory investigation;
• internal investigation;
• harassment complaint;
• whistleblower complaint;
• employee grievance;

it should consider issuing an appropriate legal hold or preservation instruction.

The hold should identify relevant:

• custodians;
• systems;
• devices;
• mailboxes;
• cloud repositories;
• messaging platforms;
• HR databases;
• personnel files;
• access logs;
• backup systems.

5. Legal Hold and Metadata

A legal hold should specifically consider metadata.

A weak preservation notice might say:

"Do not delete documents relating to the employee."

A stronger instruction should also cover:

emails, electronic messages, attachments, document versions, audit logs, access logs, system records, and associated metadata.

This is important because employees can unintentionally destroy metadata simply by:

• moving files;
• opening and resaving documents;
• converting files;
• forwarding emails;
• copying documents;
• changing file formats.

6. Integrity and Hashing

For important electronic evidence, organizations may use cryptographic hash values.

A hash functions as a digital fingerprint of a file.

For example:

Original file → SHA-256 hash → preserved copy

If the file subsequently changes, its hash will normally change.

This can help demonstrate that the preserved electronic evidence has not been altered.

Hashing is especially useful for:

• forensic images;
• investigation files;
• employee devices;
• database exports;
• electronic communications;
• surveillance records.

However, hashing alone does not prove that the underlying document is truthful. It primarily assists in demonstrating that a particular digital object has remained unchanged since the hash was calculated.

7. Chain of Custody

Metadata preservation should be combined with a documented chain of custody.

The organization should record:

1. Who collected the evidence.
2. When it was collected.
3. From which system/device it came.
4. How it was collected.
5. What format was preserved.
6. Whether a forensic image was created.
7. Who accessed it afterward.
8. Whether it was copied or transferred.
9. Where it was stored.
10. Whether its integrity was verified.

This becomes particularly important where electronic evidence is challenged.

8. Email Metadata

Email is one of the most important areas of metadata preservation.

Organizations should, where relevant, preserve:

• complete email headers;
• sender and recipient information;
• timestamps;
• Message-ID;
• subject;
• attachments;
• mailbox location;
• server information;
• routing information;
• relevant system logs.

A screenshot of an email is generally much weaker than preservation of the original electronic message and its associated information.

For employment disputes, this may be critical in determining whether:

• a warning was actually sent;
• management knew about a complaint;
• an employee reported harassment;
• an employee was informed about a policy;
• termination discussions occurred before the stated reason for dismissal.

9. Document Metadata

Office documents can contain information such as:

• author;
• last modified by;
• creation date;
• modification date;
• revision information;
• comments;
• tracked changes;
• document properties.

These may become relevant in disputes concerning:

• disciplinary warnings;
• performance improvement plans;
• employment contracts;
• investigation reports;
• redundancy selection;
• restructuring;
• compensation decisions.

However, metadata should not automatically be treated as conclusive proof of authorship or timing because metadata can sometimes be altered, stripped, or generated by software.

10. HRIS and Audit-Trail Metadata

Modern HR systems create extensive metadata.

For example, a salary change may generate:

Employee ID → old salary → new salary → user who changed it → timestamp → approval → reason code

This information can be highly important in:

• payroll disputes;
• discrimination claims;
• bonus disputes;
• promotion disputes;
• salary reduction cases;
• unauthorized access investigations.

Organizations should therefore avoid routinely deleting system audit logs where a legal, regulatory, contractual, or investigative reason requires their preservation.

11. Chat and Collaboration Platforms

Organizations increasingly rely on:

• Microsoft Teams;
• Slack;
• workplace messaging systems;
• collaboration platforms;
• internal ticketing systems.

Preservation should consider:

• original messages;
• timestamps;
• sender information;
• channel information;
• attachments;
• edits;
• deletions;
• reactions;
• relevant thread information.

Simply exporting visible chat messages may not preserve every underlying attribute.

12. Metadata Preservation and Privacy

Metadata preservation does not mean that an employer may collect everything indefinitely.

Organizations must balance:

Evidence preservation + legal obligations + privacy + proportionality + data minimization.

This is particularly important where records contain:

• employee personal information;
• health information;
• counselling information;
• private communications;
• biometric information;
• location data.

A preservation programme should therefore define:

• scope;
• purpose;
• access controls;
• retention period;
• permitted users;
• deletion procedures after the preservation obligation ends.

13. Preservation Versus Retention

These concepts should be distinguished.

Retention

A general policy stating:

"HR records are retained for X years."

Preservation

A targeted requirement arising because a particular record may be relevant to:

• litigation;
• investigation;
• regulatory proceedings;
• grievance;
• audit.

A record scheduled for deletion under a normal retention policy may nevertheless need to be preserved because of a legal hold.

14. Metadata Spoliation

Spoliation occurs when potentially relevant evidence is destroyed, altered, concealed, or otherwise made unavailable when there is an obligation to preserve it.

Metadata can be spoliated by:

• deleting files;
• overwriting logs;
• wiping devices;
• changing timestamps;
• deleting emails;
• allowing automatic deletion;
• failing to suspend a retention rule;
• converting original files into formats that discard relevant information.

Consequences may include:

• adverse evidentiary inferences;
• exclusion of evidence;
• sanctions;
• credibility problems;
• procedural penalties;
• difficulty proving the organization's case.

The exact consequence depends on the jurisdiction, applicable procedural law, significance of the evidence, and degree of fault.

15. Metadata Preservation in Employment Litigation

Consider an employee alleging:

"The company fabricated the performance warnings after deciding to terminate me."

The employer may need to establish:

1. When the warning was created.
2. Who drafted it.
3. Who reviewed it.
4. When it was communicated.
5. Whether earlier versions existed.
6. Whether performance concerns existed before termination.
7. Whether relevant emails preceded the termination decision.

Metadata, version history and email records may therefore become central to the dispute.

16. Six Important Case Laws

The following cases are particularly useful for understanding electronic evidence, authenticity, preservation, discovery and the evidentiary significance of digital records.

1. Anvar P.V. v. P.K. Basheer

(2014) 10 SCC 473

The Supreme Court of India significantly clarified the treatment of electronic records under the Evidence Act.

The Court emphasized the statutory requirements applicable to electronic evidence and the importance of compliance with the special evidentiary regime governing electronic records.

Relevance to metadata preservation:
Electronic evidence should not be treated merely as an ordinary documentary record. Proper preservation of the electronic source and associated information is important when authenticity and admissibility are disputed.

2. Arjun Panditrao Khotkar v. Kailash Kushanrao Gorantyal

(2020) 7 SCC 1

The Supreme Court revisited the principles concerning electronic evidence and certificates under Section 65B of the Indian Evidence Act.

The decision is especially significant because it explained the relationship between the original electronic record, secondary copies and the statutory certification mechanism.

Relevance:
Where electronic evidence is produced in litigation, organizations should maintain the underlying electronic record and appropriate technical information rather than relying exclusively on screenshots or informal printouts.

3. Tomaso Bruno v. State of Uttar Pradesh

(2015) 7 SCC 178

The Supreme Court recognized the importance of electronic and scientific evidence and observed that modern technology can provide valuable evidence in judicial proceedings.

The case also highlighted the importance of properly obtaining and considering available electronic evidence.

Relevance:
Employers should consider electronic records, system logs, recordings and other digital evidence when investigating employment-related disputes.

4. Shafhi Mohammad v. State of Himachal Pradesh

(2018) 2 SCC 801

The Supreme Court considered the practical difficulties surrounding production and certification of electronic evidence.

Although subsequently clarified by the larger-bench decision in Arjun Panditrao Khotkar, the case remains relevant to understanding the development of Indian electronic-evidence jurisprudence.

Relevance:
Organizations should avoid assuming that a party can simply rely upon a digital copy without considering how the electronic record was obtained, preserved and authenticated.

5. Kundan Singh v. State

(Delhi High Court, 2015)

The Delhi High Court considered issues concerning electronic evidence and the reliability and admissibility of electronic material.

The case illustrates why the evidentiary value of digital records depends not merely on the existence of electronic material but also upon demonstrating its authenticity and compliance with applicable evidentiary requirements.

Relevance:
Metadata, source information and preservation procedures can help establish the reliability and provenance of electronic records.

6. State (NCT of Delhi) v. Navjot Sandhu

(2005) 11 SCC 600

The Supreme Court considered electronic records and computer-generated evidence in the context of a criminal prosecution.

Although later jurisprudence changed and refined aspects of the electronic-evidence framework, the case remains historically important in the development of Indian law concerning electronic records.

Relevance:
It demonstrates the judiciary's long-standing recognition that computer-generated information can have evidentiary significance and that questions concerning its source and reliability are important.

17. Practical Metadata Preservation Policy

An organization can adopt the following framework.

Step 1 — Identify the Trigger

Preservation should begin when there is a reasonable possibility of:

• litigation;
• regulatory investigation;
• employee complaint;
• internal investigation;
• arbitration;
• disciplinary proceedings.

Step 2 — Identify Custodians

Identify relevant:

• employees;
• managers;
• HR personnel;
• legal personnel;
• IT administrators;
• investigators.

Step 3 — Identify Systems

Map relevant information across:

• email;
• HRIS;
• payroll;
• Teams/Slack;
• document management;
• cloud storage;
• laptops;
• mobile devices;
• access-control systems.

Step 4 — Suspend Destruction

Where legally appropriate, suspend:

• automatic deletion;
• mailbox purging;
• document deletion;
• log rotation;
• device wiping.

Step 5 — Preserve Metadata

Preserve relevant:

• timestamps;
• headers;
• audit trails;
• version history;
• user information;
• file properties;
• system logs.

Step 6 — Maintain Chain of Custody

Document every significant transfer or access.

Step 7 — Verify Integrity

Use appropriate controls such as:

• cryptographic hashes;
• read-only storage;
• forensic images;
• access logs.

Step 8 — Restrict Access

Only authorized personnel should access preserved evidence.

Step 9 — Document Exceptions

If metadata cannot be preserved, document:

• what was unavailable;
• why it was unavailable;
• when it became unavailable;
• what alternative evidence exists.

Step 10 — Release the Hold

Once the preservation obligation ends, records should be handled under the organization's ordinary retention and deletion rules, subject to any continuing legal requirements.

18. Metadata Preservation Checklist for HR

19. Key Compliance Principles

A strong metadata preservation programme should follow these principles:

Authenticity — preserve evidence in a manner that permits its source to be demonstrated.

Integrity — prevent unauthorized alteration.

Completeness — preserve relevant metadata along with the substantive record.

Traceability — maintain an audit trail showing what happened to the evidence.

Proportionality — preserve what is reasonably relevant rather than indiscriminately collecting everything.

Security — protect preserved information against unauthorized access.

Privacy — avoid unnecessary collection and retention of personal information.

Timeliness — activate preservation procedures promptly once a preservation obligation arises.

Defensibility — maintain written procedures showing why, how and for how long information was preserved.

20. Conclusion

Metadata preservation is an increasingly important component of electronic evidence management, HR compliance and employment litigation readiness. A document without its surrounding electronic information may provide only part of the evidentiary picture.

For employers, the practical objective should be to preserve not merely "the document", but, where relevant, the document + metadata + audit trail + version history + provenance + chain of custody.

The most important operational rule is:

When litigation, investigation or regulatory scrutiny is reasonably foreseeable, preserve relevant electronic records in their original or forensically reliable form and protect the associated metadata from alteration or automatic deletion.

This approach strengthens the organization's ability to establish authenticity, chronology, authorship, integrity and reliability while reducing the risk of allegations of evidence destruction or manipulation.