GDE-069 |
PDF metadata analysis | |||||||
Digital forensics | ||||||||
October 2026 | ||||||||
01
What it is
PDF metadata is the information a PDF file stores about itself, apart from its visible pages: the title, author, creating application, PDF producer and creation and modification dates, held in a document information dictionary and an XMP metadata stream. Investigators read it to test who made a document, with what software and when.
Every PDF can carry two metadata records. The document information dictionary holds standard fields from Title and Author to CreationDate and ModDate. The XMP stream is a block of XML that can repeat those fields and add more, such as an edit history. Software writes both records, and the two do not always agree.
A PDF can also keep earlier versions inside the same file. When software saves a change as an incremental update, it appends the new data and leaves the old in place, so a replaced author name or title can often be recovered. Journalists, fraud examiners and due diligence teams use both records to test a leaked or published document against the account given of it.
| When to use this guide
|
02
How do you check PDF metadata and recover earlier versions?
Five free tools and seven steps take you from a single file to a documented, corroborated reading of its metadata.
All five tools are free, and four of them run on your own machine with no account.
ExifTool: Free, open source, no login. Phil Harvey's command-line tool reads information dictionary and XMP tags side by side and labels the record each value came from. Its documentation notes that PDF edits made with it are reversible.
pdfinfo: Free, open source, no login. Part of the Poppler command-line utilities, it prints the information dictionary fields, PDF version and page count, and with the -meta option prints the XMP metadata stream.
PDFResurrect: Free, open source, no login. Counts the versions held inside a PDF and writes each earlier version out as a separate file, leaving the original untouched.
qpdf: Free, open source, no login. Rewrites a PDF as one clean file, dropping the superseded data that incremental updates leave behind.
Adobe Acrobat Reader: Free download. Document Properties (Ctrl+D on Windows, Cmd+D on Mac) shows the title, author, dates and creating application in one panel, a quick first look without the command line.
| Before you begin Stop at the login. ExifTool, pdfinfo, PDFResurrect and qpdf run locally with no account. If Acrobat Reader prompts you to sign in, decline; Document Properties works without one. Avoid online viewers that upload the file to a third party. Legal considerations. Author fields can name private individuals, so treat them as personal data under the GDPR and UK GDPR and keep only what you need. With a leaked document, check whether its metadata could expose a source before you report it. |
Save the PDF exactly as received, with its source, date and time. Hash it with sha256sum before you open it and work on a copy, since saving in an editor can add a version and overwrite the fields you want to read.
Run pdfinfo -isodates file.pdf and record Title, Author, Creator, Producer, CreationDate and ModDate. Creator usually names the application the document was written in and Producer the software that made the PDF. An empty field is a finding to note, not a gap to fill.
Run pdfinfo -meta file.pdf to print the XMP stream, or exiftool -a -G1 file.pdf to see both records side by side. A tool that edits only one record leaves the other untouched, so an author or date that differs between them points to a change made after creation.
Run pdfresurrect -q file.pdf to count the versions held in the file. If there is more than one, pdfresurrect -w file.pdf writes each version to its own file. Compare the metadata and pages of each to see what changed and in which order.
Check the creation date against the date the document claims, and Creator and Producer against how it was said to be made. A letter described as a scan but produced by a word processor, or created after the date it carries, needs explaining. Corroborate with an email timestamp or a Wayback Machine capture.
Keep the raw tool output and separate what the file records from what you infer. Metadata shows what software wrote, not who wrote the document, so grade any attribution with a confidence tier.
Clear the fields with exiftool -all:all= file.pdf, then rewrite the file with qpdf --linearize file.pdf clean.pdf so the cleared values cannot be recovered. Check the clean copy with pdfinfo and ExifTool before it leaves your hands.
|
03
Where PDF metadata misleads an investigation
Most errors come from reading a field that software wrote as a statement made by a person.
Author field read as the writer: Software usually fills the Author field from a computer user name, a licence or a template, and it carries over when one document is built from another. Verifying check: confirm any name against an independent source, such as the sender or a staff directory, before you attribute authorship.
Modification date read as a change to the text: ModDate changes whenever a file is saved, optimised or has its metadata edited, even when no page changed. Verifying check: compare the extracted versions to see what actually changed at each save.
Missing metadata read as concealment: Export settings, print-to-PDF drivers and web platforms can write few fields or remove them, so a blank record proves nothing on its own. Verifying check: obtain the file from the earliest available source and compare it with the copy you hold.
One version read as an unedited file: A full save, an optimiser or qpdf keeps only the latest state, so one version does not show the file was never changed. Verifying check: treat a count of one as neutral and rely on the other checks.
Producer string read as a fingerprint: Producer values name software releases shared across huge numbers of files. A match links tools, not people. Verifying check: link documents only on several shared fields, such as an unusual author with matching dates, and confirm with a second source.
Chain of custody: A metadata finding is only as strong as the record of which file was examined, where it came from and which tool read it. Keep the original sealed and log each step so an editor or court can repeat it.
Hash the original PDF with SHA-256 before any tool touches it
Save the full text output of pdfinfo and ExifTool with the date and tool version
Keep each version extracted by PDFResurrect with its own hash
Record where, when and from whom the file was obtained
Store the original apart from every working or cleaned copy
04
Go deeper
Two reference cards and one Methods tutorial for preserving evidence and protecting your own footprint.
CARD · OPS-001
OPSEC for investigators: eight-step security baseline
Signal, Mullvad and ProtonMail, configured from threat model to documented session.
CARD · SOC-002 · SIGNAL TIER
Social media evidence preservation for investigators
Hunchly and the Wayback Machine, used to capture, hash and archive content before takedown.
METHODS · CZ2
Investigating yourself: the OSINT dry run on your own digital footprint
A structured self-audit of your own footprint, with a remediation list and a re-run cadence.
Evidentiary standard
Signal & Shadow operates to the LST-001 evidentiary standard. All claims are graded against the LST-001 v1.0.3 confidence tiers (Confirmed, Corroborated, Reported, Alleged) per the canonical voice and structural specification.
About Signal & Shadow
Signal & Shadow is an independent forensic investigation and methodology practice publishing tutorials, reference cards, and forensic dossiers for working practitioners. Founded by Derek Bowler.