In more detail
Photos carry EXIF, Office files and PDFs record the author and editing software, and every file system keeps timestamps. Email adds routing headers, and many formats store the program that created them. Metadata helps investigators reconstruct who made a file and when, and it can leak private details unintentionally, so remove it before publishing sensitive documents. It is generally stored apart from the visible content, which is why it survives copying and is easy to forget.
Why it matters
A photo posted online can carry the camera model, the time it was taken and even GPS coordinates; a Word file can reveal the author's name and who edited it last; a PDF can name the software that produced it. For an investigator, metadata is evidence, but weak evidence: anyone can edit it with common tools, and some of it is rewritten by the system itself. Treat it as a lead to corroborate, not as proof, and compare it with the file's content and with other timestamps.
Example
Even a plain text file has metadata kept by the file system, not inside the file:
$ stat -c '%n %s bytes, modified %y' notes.txt
notes.txt 3 bytes, modified 2026-03-02 09:15:00.000000000 +0000
The file's contents, hi, say nothing about when it was written; the date comes from the file system. Moving a file to another system, or extracting it from an archive, can change or drop those timestamps. To strip hidden fields from an image before sharing it, use the EXIF Metadata Remover; to read them, open the file in the Image Forensics or Document Forensics.
Common confusion
Metadata is not the file's hidden "secret" content, only descriptive data about it. Deliberately altered timestamps are a known anti-forensic trick; see Timestomping.