GDE-074 |
Metadata removal | |||||||
OPSEC | ||||||||
October 2026 | ||||||||
01
What it is
A metadata remover is a tool that deletes the hidden data a file stores about itself, such as the author's name, the device, GPS coordinates and edit history, so a photo, document or video can be shared without revealing who made it or where.
Metadata travels inside the file, not on the page. A phone photo can carry EXIF tags with the camera model, capture time and location. A Word file can hold the author, the organisation, comments and tracked changes. A PDF keeps its own information fields and can keep earlier versions of itself.
Removing that layer is the defensive side of metadata analysis. Journalists, editors and investigators handling source material use a metadata remover on the copies they release, while the original stays sealed as evidence. Done well, it protects sources, colleagues and your own working history.
| When to use this guide
|
02
How do you remove metadata from a file and prove it is gone?
Five tools and seven steps take a file from a sealed original to a verified clean copy.
Four of the five tools are free and run on your own machine, so the file never has to leave your control.
ExifTool: Free, open source, no login. Phil Harvey's command-line tool reads and deletes metadata in images, video, audio and PDFs. By default it keeps the untouched file with _original added to its name, so check where that backup sits before you share a folder.
mat2: Free, open source, no login. A command-line metadata remover for images, PDFs, Office and OpenDocument files, audio and video. It writes a new copy with .cleaned in the name, and its documentation warns that a file is not proven clean just because mat2 shows nothing.
Metadata Cleaner: Free, no login. A Linux desktop app that shows a file's metadata and removes as much of it as it can. It is included by default in Tails, the amnesic operating system.
qpdf: Free, open source, no login. Rewrites a PDF as a single clean file. ExifTool's own documentation recommends it to remove for good the old values that ExifTool's PDF edits leave inside the file.
Microsoft Document Inspector: Paid, included with the Microsoft Office desktop apps. Under File, Info, Check for Issues, Inspect Document, it finds and removes comments, revisions, document properties, personal information and hidden content in Word, Excel and PowerPoint files.
| Before you begin Stop at the login. ExifTool, mat2, Metadata Cleaner and qpdf run locally with no account. If an online metadata remover asks you to upload a file or sign in, stop: the upload itself hands the file and its metadata to a third party. Legal considerations. Keep the unaltered original of any file that may become evidence, since a stripped copy carries less weight with a court or regulator. Author fields can name private individuals, so treat them as personal data under the GDPR and UK GDPR and record what you removed and why. |
Hash the file with sha256sum and store it apart from your working folder. Every step below runs on a copy, never on the original you may later need to produce.
Run exiftool -a -G1 file to list every tag with the group it sits in, or mat2 --show file. Note anything sensitive, such as GPS coordinates, a user name, a serial number or a company name, so you can confirm later that it is gone.
Run exiftool -all= photo.jpg to delete every writable tag, including GPS. ExifTool's documentation notes this also removes colour space information, so check the image still looks right, and confirm it is not displayed rotated.
In Word, Excel or PowerPoint, run Document Inspector and remove comments, revisions and document properties before you export. For a PDF, run exiftool -all:all= file.pdf, then qpdf --linearize file.pdf clean.pdf so the cleared values cannot be restored.
For audio, video, OpenDocument files or a folder of mixed formats, run mat2 file or open the files in Metadata Cleaner. mat2 writes copies with .cleaned in the name; move only those copies into your outgoing folder.
Run exiftool -a -G1 on the cleaned file and compare it with your inventory from step 02. Size and modification date will still show, because they come from your computer, not the file. Rename it too: a camera number or document title can identify a source.
A metadata remover clears data about the file, not what the file shows. Before release, check images for faces, reflections, street signs and screens, and documents for names in headers, distinctive wording or printer tracking dots on scans.
|
03
Why a metadata remover can still leave you exposed
Most failures come from trusting what a tool reports instead of checking the file that actually leaves your hands.
Platform stripping read as protection: Many social platforms strip location tags from uploaded photos, but not every route does. Files sent as documents, by email or through cloud links usually arrive with their metadata intact. Verifying check: download the file exactly as the recipient receives it and inspect that copy with ExifTool.
Location removed read as metadata removed: Phone and editing app options often remove location alone and leave the device model, capture time, editing software and the photographer's name. Verifying check: run a full tag listing and confirm that every sensitive field from your inventory is absent, not only the coordinates.
Cleared PDF fields read as a clean PDF: ExifTool records PDF edits as an incremental update, so the original values stay inside the file and can be restored. Verifying check: confirm the file was rewritten with qpdf after editing, and that ExifTool run on the new copy shows none of the original values.
An empty tool report read as a clean file: mat2's documentation states that a file is not necessarily clean just because mat2 displays no metadata, and complex formats can hold data a tool does not parse. Verifying check: cross-check with a second tool, and keep the formats you release as simple as the material allows.
A clean file read as an anonymous file: Removing metadata does nothing about what the image or document shows, which is often what identifies a source. Verifying check: have a second person review the visible content and the filename against your threat model before publication.
Chain of custody: Removing metadata changes the file, so the record has to show which original each clean copy came from, what was removed and with which tool. Keep the original and its hash so you can show an editor, a lawyer or a court exactly what you started with.
Hash the original and every cleaned copy with SHA-256 and log both values
Save the full ExifTool tag listing from before and after removal
Record the tool, version and command used on each file
Store originals in encrypted storage, apart from every cleaned copy
Note who approved the release of each cleaned file and when
04
Go deeper
Two reference cards and one Methods tutorial on protecting your sources, your devices and your own footprint.
CARD · OPS-001 · SIGNAL TIER
OPSEC for investigators: eight-step security baseline
Signal, Mullvad and ProtonMail, configured from threat model to documented session.
CARD · HUM-002 · SIGNAL TIER
Secure source communications: Signal, SecureDrop, Tails
Signal, SecureDrop and Tails, used to receive documents without exposing the source.
METHODS · CZ2 · SIGNAL TIER
Investigating yourself: the OSINT dry run on your own digital footprint
A structured self-audit of your own footprint, with a remediation list and a re-run cadence.
Evidentiary standard
Signal & Shadow operates to the LST-001 evidentiary standard. All claims are graded against the LST-001 v1.0.3 confidence tiers (Confirmed, Corroborated, Reported, Alleged) per the canonical voice and structural specification.
About Signal & Shadow
Signal & Shadow is an independent forensic investigation and methodology practice publishing tutorials, reference cards, and forensic dossiers for working practitioners. Founded by Derek Bowler.