Ten Tests for Microsoft s Document Inspector: Does it satisfy the Metadata Management Needs of Law Firms?

Ten Tests for Microsoft s Document Inspector: Does it satisfy the Metadata Management Needs of Law Firms? Esquire Innovations, Inc., a leading provider of Microsoft Office integrated practice management software services and applications for the legal market, counts more than 550 law firm and in house council clients utilizing its applications. Esquire Innovations has been developing, supporting, and selling document creation, formatting, re purposing, comparing, and metadata management software applications in the legal industry since 1999.Innovative Software + Astonishing Services = Extraordinary Client Success Randall Farrar Esquire Innovations, Inc. May 2008 i P a g e

Table of Contents Introduction to Document Inspector...1 Test 1. Understanding Document Inspector s Real Purpose...1 Test 2. The User Must Inspect the Document...5 Test 3. Document Inspector Removes Metadata from the Original...5 Test 4. Test 5. Test 6. Header Footer Removal is Destructive...6 Not all Databinding Link Information Is Removed In Office 2007 Word...7 Office 2007 Excel Formula Errors Will Occur when Hidden Rows, Columns and Worksheets are Deleted...7 Test 7. There are Many Metadata Elements That Cannot Be Managed...8 Test 8. Only One Level of Metadata Management...12 Test 9. It does not Prevent Metadata Disclosure from Email Attachments...13 Test 10. Lack of E Discovery Features...13 ii P a g e

Introduction to Document Inspector Document Inspector is Microsoft's response to the market's outcry about the hidden data that can so easily be stored in a Microsoft Office document. When sharing these files outside of a company or firm, there is risk of disclosing unintentionally discoverable, confidential or hidden information that might be adverse to client representation or, at least, extremely embarrassing. Prior to Office 2007 Document Inspector, Microsoft provided a metadata removal tool (called the Hidden Data tool) that was barely usable and kludgy at best. The Office 2007 Document Inspector was a needed addition. With the advent of Microsoft Office 2007 (Office 2007) and the addition of Document Inspector, many firms are asking whether there's a need for an additional metadata management application. Has Microsoft, in one single blow, nullified many companies' investment in a metadata management application? If metadata management is now built in, why use another application? In this whitepaper we run Document Inspector through ten tests to determine if firms should solely rely on Document Inspector for metadata management, or if they should still consider investing in a metadata management application. Test 1. Understanding Document Inspector s Real Purpose Microsoft's idea behind Document Inspector is to provide a central location for users to view Office 2007 documents for personal, hidden, or sensitive information. To view or remove this information a user can use the built in Document Inspector and an organization could, conceivably, extend Document Inspector (see Figure 1) with additional development using the Document Inspector Object Model. To View Document Inspector 1. Click the Office Button 2. From the drop down menu select Prepare 3. From the list to the right select InspectDocument 1 P a g e

Figure 1 Document Inspector is Composed of Three Modules Document Inspector is composed of three modules to inspect and remove specific metadata from documents Office 2007 Word Document Inspector, Office 2007 Excel Document Inspector, and Office 2007 PowerPoint Document Inspector Metadata Elements for Office Word 2007: Comments Revision marks from tracked changes Document version information Ink annotations Document properties, including information from the Summary, Statistics, and Custom tabs of the Document Properties dialog box E mail headers 2 P a g e

Routing slips Send for review information Document server properties Document Management Policy information Databinding link information for databound fields (last value will be converted to text) Note: Does not handle some linked fields such as IncludeText, User name Template name Text that is formatted as hidden (a font effect that is available in the Font dialog box) Metadata Elements Discovered by Document Inspector for Excel: Comments Ink annotations Document properties, including information from the Summary, Statistics, and Custom tabs of the Document Properties dialog box E mail headers Routing slips Send for review information Document server properties Document Management Policy information User name Printer path information Scenario comments File path for publishing Web pages Comments for defined names and table names Inactive external data connections Information in worksheet headers Information in worksheet footers Hidden rows Hidden columns that contain data Objects that are not visible because they are formatted as invisible Metadata Elements Discovered by Document Inspector for PowerPoint Comments Ink annotations Document properties, including information from the Summary, Statistics, and Custom tabs of the Document Properties dialog box E mail headers Routing slips Send for review information Document server properties Document Management Policy information 3 P a g e

File path for publishing Web pages Objects that are not visible because they are formatted as invisible Text that was added to the Notes section of a presentation Custom XML data that might be stored within a presentation Removing Metadata from the Office 2007 Document Once the user selects Inspect (see Figure 1), the Document Inspector dialog box displays the type of metadata found in the document. After displaying the metadata Document Inspector provides buttons to remove the metadata (see Figure 2). Figure 2 Once the user selects which metadata to remove, they can recheck the document for metadata by selecting the Reinspect button (see Figure 2) 4 P a g e

Test 2. The User Must Inspect the Document Document Inspector's lack of extensive out of the box metadata management ability is not suited to an enterprise metadata management approach. The onus is on individual users to "inspect" their documents and then decide what to remove. With the Federal Rules of Civil Procedure relating to electronically stored information, relying on Document Inspector places the company or firm at risk of "...inadvertent production of privileged information." A firm should decide how to manage a document's electronic information (metadata) from an enterprise wide approach, not the individual users. Test 3. Document Inspector Removes Metadata from the Original Document Inspector does not publish a result document, so the accidental removal of metadata is very easy. When the user removes metadata using the Document Inspector these are deletions that cannot be undone (see Figure 3). Figure 3 In firms where document collaboration and client work product are the currency, accidental metadata destruction can be quite costly. Imagine a scenario where an attorney asks a secretary to send an agreement he s been working on allnight to his client. This particular document contains his and a colleague s comments along with their track changes. He tells the secretary to send the client a copy with the metadata scrubbed. The secretary uses Document Inspector to inspect the document and notices that this document has Revision marks and Comments with a red EXCLAMATION POINT! (see Figure 4). This must not be good, so he selects Remove All and then realizes in a panic that this was the original. He tries to undo the removal but cannot. Document Inspector does not preserve the original and makes it too easy to lose important metadata from the original. As you can see from the example above some metadata is invaluable to the document production process. Along with this, Document Inspector uses the term Revision when in fact it is Track Changes this is confusing. 5 P a g e

Figure 4 Below is a list of metadata the inspector removes that cannot be undone for Office 2007 Word: Comments Revisions (Track Changes) Versions Annotations Custom Properties Template Name Statistics Data binding link information for data bound fields (last value will be converted to text) Template name CAUTION: Document Inspector does not always remove personal information in Office 2007 Word. In the Hidden Data Tool provided with Office 2003, when personal information was removed the author info was removed from track changes. In Document Inspector the author information is NOT removed. Test 4. Header Footer Removal is Destructive Here s a feature of Document Inspector I just don t get. When the Headers, Footers and Watermarks (see Figure 5) are removed, the Document Inspector removes everything in the footer, including the page number. Figure 5 For long documents such as agreements, contracts and corporate documents where the footers are complex, this can cause some major problems and heartache! This can be Undone, but if you forget and save it first, then it is gone. 6 P a g e

Test 5. Not all Databinding Link Information Is Removed In Office 2007 Word There are fields in all versions of Microsoft Word that can contain link data in the form of text, pictures and hyperlinks that can reference files on a server. Document Inspector does not remove or unlink (turn the field to text) these type of links. Here are examples of Link Fields that are not removed using the Document Inspector (notice these have the server name and path information): { HYPERLINK "\\\\PRODEV\\People\\JDoe\\DOCS " \l "609447 v18 Bylaws.DOC" } { INCLUDEPICTURE \\\\ PRODEV \\People\\ JDoe\\iRedlineLogo.gif" \* MERGEFORMAT } { LINK Equation.3 \\\\ PRODEV \\People\\ JDoe\\iRedlineLogo.gif" \p } { INCLUDETEXT "\\\\ PRODEV \\People\\ JDoe\\DOCS #609447 v18 Bylaws.DOC" \* PRODEV } Test 6. Office 2007 Excel Formula Errors Will Occur when Hidden Rows, Columns and Worksheets are Deleted Beware of deleting hidden rows, columns and worksheets with Document Inspector in Excel (figure 6). If you have formulas in a document that are referencing other values in a hidden row, column or worksheet and Document Inspector removes them you will get error (#REF!) in your formulas that referenced them. An enterprise metadata management solution will convert the formulas to values before unhiding or deleting these items. 7 P a g e

Figure 6 Test 7. There are Many Metadata Elements That Cannot Be Managed Document Inspector lacks the ability to manage much metadata. And unless a firm invests in development efforts to extend it, Document Inspector is not robust enough to implement as an enterprise metadata management policy. Additionally, Document Inspector does not show you what the metadata is, or where it is. For instance, once the user inspects the document, Document Inspector will tell you that you have document properties (built in and custom), but does not show what the document properties are. This metadata may contain case supporting evidence that should be disclosed or discovered. Because Document Inspector lacks the ability to view specific metadata, and if this metadata is left in the document, the "producing party must notify the opposing party and court, and retrieve the information should privileged information be inadvertently produced." 1 This can be costly and embarrassing. 1 Michele C.S. Lange, Esq. "New FRCP Rules: What Does it Mean for You" MSBA Computer and Technology Law Section. December 01, 2006, http://mntech.typepad.com/msba/2006/12/new_frcp_rules_.html 8 P a g e

The table below shows the metadata Document Inspector removes, compared to the metadata that Esquire Innovation s Metadata Management solution iscrub 2 manages. Metadata Element Multiple Document Scrub (Batch Scrubbing) Word Document Inspector Removes No iscrub Manages Comments Change Author Names No Track Changes Document Variables No Document server properties Document Management Policy information Keep Track Changes No Remove Author Revision Number Versions Annotations Built in Properties Custom properties Preserve specific No Custom properties Personal Information Custom XML Data E mail head ` Hidden Text Keep Track Changes No Remove date and time Bookmarks No Unused Styles No Normalize Custom No Styles names Set Compatibility No Diminutive Fonts No Document Variables No Embedded True Type Fonts No 2 iscrub version 5 for Microsoft Office 2007 9 P a g e

Metadata Element Document Inspector iscrub Manages Removes Field Codes No Hyperlinks No Hyperlink history No Include Text Fields No That contain network paths Invisible Ink No Linguistic Data No Linked Objects No Random Number No Routing Slips Smart Tags No Style Sheets No IncludePicture Fields No Edit Time Print Date No Creation Date No Modified Date No Convert Legacy No document to Docx Send for review information Template name Excel Comments All external data No connections Keep Comments No Remove Author Comments for defined names and table names Annotations Built in Properties Custom properties E mail head ` Personal Information Custom XML Data Document server properties Document Management Policy 10 P a g e

Metadata Element Document Inspector iscrub Manages Removes information Headers and Footers Headers and Footers No Specify Left, Center or Right Footers only Delete Hidden Rows and Columns Unhide Hidden Rows No and Columns Delete Hidden Sheets No Unhide Hidden Sheets No Linked Objects No Invisible Objects Note: Document Inspector cannot detect text that was hidden by other methods (for example, white text on a white background). Printer path information Track Changes No Custom Number No Formats Custom Style No Custom Views No Diminutive Fonts No External Links No Fonts Matching Cell No Color Formulas No Hyperlinks No Hyperlink history No Normalize Sheet No Names Pivot Tables disable No refresh Pivot Tables remove No cache Data Pivot Tables remove No Data Connection Pivot Tables remove No 11 P a g e

Metadata Element Document Inspector iscrub Manages Removes Refresh Authors Range Names No Scenarios No Smart Tags No PowerPoint Comments Annotations Built in Properties Custom properties E mail head ` Personal Information Custom XML Data Invisible On Slide Content Document server properties Document Management Policy information Presentation Notes Headers Footers No Delete Hidden Slides No Unhide Hidden Slides No Hyperlinks No Hyperlink history No Linked Objects No Notes Master No Slide Master No PDF documents No Document Title No Document Author No Document Subject No Keywords No Application Creator No Application Producer No Test 8. Only One Level of Metadata Management Metadata should be managed differently depending on who the document is being sent to, or its intended purpose. If a document is going to a client or collaborator then perhaps only certain metadata elements might be removed. If 12 P a g e

the document is going to an adverse party, then most (if not all) of the document's metadata should be removed. A company may wish to provide several standardized levels of metadata management to their users, thus removing the decision making responsibility from the individual, and transforming the process into a conscious enterprise approach. Document Inspector only provides one level of inspection and removal. This disadvantage makes Document Inspector a poor choice for enterprise metadata management. Document Inspector relies on each user to understand and remove metadata components they happen to think are potentially damaging. Therefore by its nature (to be effective), extensive user education and training is required. An enterprise metadata management solution enables a firm to set up fixed standards for metadata management and enforce those standards. Users simply select one of the levels available to them there is no guess work and little training is needed. Test 9. It does not Prevent Metadata Disclosure from Email Attachments Document Inspector only works within its intrinsic Office Object Model, and will not prompt users to remove metadata from e mail attachments. Once again, the firm must put its trust in the individual user; trust in his/her memory to actually apply Document Inspector before attaching the document, and trust in his/her judgment or knowledge to remove the proper elements for that specific transaction. An enterprise metadata management solution should prompt the user to manage metadata in Microsoft Office attachments to an e mail. When a user has an attachment, the application should recognize it, and remove the metadata as the document exits the company s electronic walls. Test 10. Lack of E Discovery Features As more and more companies are instituting E discovery processes for managing internal electronic information (metadata), the ability to report on the specific metadata within a document, and the metadata that has been removed, becomes paramount. Document Inspector lacks any reporting capability and, in fact, the user has no idea what has been removed or where it was in the document. 13 P a g e

Summary Document Inspector is significantly lacking as an enterprise metadata management tool. The limited number of metadata elements that can be removed (much less viewed or actually managed) makes it a poor choice for document intensive organizations that truly need to manage their discoverable metadata. The cost and effort associated with extending the Document Inspector to a richer metadata management model will be much higher and less efficient than investing in a proven metadata product, such as iscrub. iscrub iscrub is the premier enterprise solution for metadata management in document intensive organizations. iscrub uses sophisticated technologies to remove the visible document properties and the difficult to reach file elements, such as the list of past authors (all document authors) and Deleted Text. iscrub provides a centralized administration feature that allows firms to establish and control the metadata removal settings this is called an enterprise metadata management approach. iscrub publishes the clean version of a document, separate from the original file, inside or outside of a document management system. iscrub works with Outlook, Lotus Notes and GroupWise to prompt users to scrub e mail attachments before sending them; automatically helping to prevent sensitive metadata information from leaving the organization. 14 P a g e