In investigative journalism, metadata hidden in PDF documents can reveal critical information about document provenance, editing history, and authorship. Understanding how to read and interpret PDF metadata is a skill that separates rigorous verification from speculation.
#1. Why PDF Metadata Matters in Journalism
When a source provides a leaked document, PDF metadata tells the story of its creation. The modification dates, author name, editing software, and revision count can help answer crucial questions: Is this document authentic? Has it been edited since publication? Who originally created it?
#2. What Metadata Can Tell You
Common fields to examine when verifying documents:
- Author/Creator: The person or system that created the file
- Subject & Keywords: Clues about document classification or internal purpose
- Creation Date: When the document was originally made
- Modification History: How many times edited and by whom (in some PDFs)
- Producer: Software used to create or modify the PDF
- Company/Organization: Corporate metadata embedded by the authoring organization
#3. Protecting Your Sources
Before publishing any document provided by a source, always strip metadata. Even when a source believes they've been careful, embedded metadata can compromise anonymity.
FileIntel's PDF Metadata Remover inspects every metadata field in seconds and removes all author identification, timestamps, and software traces with a single click—no server uploads, no logging, 100% private.
#4. A newsroom verification workflow
Treat metadata as one evidence stream, not as proof by itself. Preserve the original file in a restricted evidence directory, record its cryptographic hash, and work from a copy. Note the filename, source context, acquisition time, and transfer method before opening the document in a desktop application that might rewrite it.
Start with a read-only inspection. Compare CreationDate and ModDate, identify the Creator and Producer applications, and check whether the document contains an XMP packet, embedded files, comments, form data, or incremental updates. A date mismatch can suggest an editing sequence, but it cannot establish who edited a file or whether the file is authentic.
#5. Source communication and device hygiene
SecureDrop and Signal solve different problems. SecureDrop is designed for anonymous source submissions to participating newsrooms; Signal provides encrypted messaging but does not make a journalist's device, screenshots, downloads, or backups anonymous. Use the newsroom's established intake policy rather than asking a source to send sensitive material through a personal account or an unapproved cloud drive.
Tails can reduce local traces when it is correctly configured, but it is not a magic anonymity layer and it does not repair an already exposed document. Journalists should follow their organisation's threat model, keep operating systems and browsers updated, use multi-factor authentication, and avoid opening source files on a personal device that is also used for public social accounts. Consult a newsroom security specialist for high-risk investigations.
#6. Remove metadata from the publication copy
The file used for verification is not the file that should be uploaded to a publication system. After the reporting team has documented the original, create a separate publication copy. Remove author, company, keyword, timestamp, software, comments, attachments, hidden layers, and other fields that could identify a source or reveal internal workflow. Then inspect the exported copy again with a second tool.
Metadata removal does not anonymise visible text, image content, document layout, or distinctive language. A cropped screenshot can still contain a location clue, and a PDF can still expose a source through names, revision marks, or embedded images. Redact or recreate sensitive content separately, and ask another editor to review the final file before publication.
#7. Best practices
- Always inspect metadata before publishing—treat it as part of your source verification checklist
- Remove metadata from documents before publication using a verified tool
- Document the metadata you find as part of your verification notes (for internal use only)
- Remember: metadata removal is not the same as redaction. Use redaction for sensitive content within the document itself
- Keep the original evidence separate from the sanitised publication copy
- Have a second editor review the file and its visible content before release
Have questions about protecting documents? Read our guide on how to view PDF metadata on every platform, or use FileIntel's free metadata inspector to check your documents now.