Metadata & Document Forensics
The hidden data inside photos, PDFs, and Office files — and why you should scrub your own.
Files carry a shadow copy of how they were made: the device, the software, the author, sometimes the exact coordinates. Extracting that metadata is often cheaper than any other route to an identity.
What each format leaks
| Format | Look for |
|---|---|
| JPEG / HEIC | GPS coordinates, camera make/model, timestamps |
| Author, producer software, original filename, creation date | |
| DOCX / XLSX | Author, last-modified-by, company, editing time |
| MP4 / MOV | Device model, creation date, location (sometimes) |
| PNG / screenshots | Usually stripped by chat apps — proof of nothing |
Instagram, WhatsApp, X and most chat apps remove EXIF on upload. Do not expect GPS on a downloaded post — but a photo sent as a "document" or original file often keeps it.
How to inspect
- Desktop: `exiftool` prints every tag in a file (and works on PDFs and video).
- No-install: many online EXIF viewers exist, but they upload your file — use only on non-sensitive material.
- PDF/docx: open the properties panel, or inspect the raw file as a zip (Office files are zips).
exiftool -a -gps:all -time:all -make -model suspect.jpgThe defensive flip side
Before you publish anything, strip it. Re-encoding an image, or "remove metadata" in an editor, prevents the same trick being run against you. This is a core OPSEC habit.
Command recipes
# Everything about a file, grouped and readable
exiftool -a -G1 -s suspect.pdf
# GPS + timestamps only, as a quick hit
exiftool -a -gps:all -time:all suspect.jpg
# Strip every tag before you share (writes a clean copy)
exiftool -all= -o cleaned.jpg suspect.jpg
# Office files are zips — read the XML directly when tools fail
unzip -p report.docx docProps/core.xmlA leaked internal spreadsheet is circulating and the publisher claims it is anonymous.
Method · Open the .xlsx as a zip and read docProps/core.xml. The `dc:creator` and `cp:lastModifiedBy` fields still name an individual, and the creation date sits just before the document appeared publicly.
Result · A named author and a tight creation window, reported with the two XML fields as the source — metadata alone is a lead, so it is corroborated against the file's distribution before being treated as attribution.