What files say about the people who made them

Metadata is data about a file rather than its visible content. It is written automatically by cameras, phones and software, usually without the author's knowledge. That is what makes it valuable to investigators, and what makes it dangerous to the organizations and people who publish files without checking them.

What metadata is

There is no single kind. A photograph, a word processing document and a PDF each carry different fields, written by different software, and each can be altered or removed by the next program that touches the file. The useful question is never "what does the metadata say?" but "what wrote this field, when, and could it have changed since?"

Images

Photographs from cameras and phones typically carry EXIF data, which can include:

• The make and model of the device and, on some cameras, a serial number.
• The date and time of capture, as set on the device clock.
• GPS coordinates, altitude and direction, where location services were on.
• Exposure, lens and flash settings, which can test whether an image is what it claims to be.
• The software that last saved the file, which reveals editing.
• An embedded thumbnail, which on some devices is not updated when the main image is cropped and can show what was cut out.

Documents and PDFs

Office documents and PDFs often carry more about people than images do:

• The author and the person who last modified the file, frequently an internal username rather than a display name.
• The organization name registered to the software.
• Creation and modification dates, revision counts and total editing time.
• The template the document was built from, which can link documents produced by the same person or office.
• Comments, tracked changes and hidden text that were never meant to leave the building.
• For PDFs, the application that created the original and the one that converted it, and sometimes a history of edits.

What survives, and where to look

Large social platforms strip most metadata from uploaded images, and many messaging apps recompress files. That leads some investigators to stop looking. They should not. Metadata frequently survives in:

• Files sent directly by email or attached to messages as documents rather than images.
• Images and documents on personal websites, blogs, forums and file-sharing links.
• Corporate websites, investor materials and public document libraries.
• Samples posted by extortion groups and leak sites, which we examine in Verify before you panic.

When a platform copy has been stripped, an earlier copy of the same file elsewhere may not have been. Finding it is part of the work.

Reading metadata without changing it

Opening a file in the wrong program can change it. Some software updates access dates or rewrites fields on save. Our practice is to hash the original at capture, work only on verified copies, and extract metadata with tools whose version and settings are recorded in the case notes. The extracted fields are preserved alongside the file, so the reading can be reproduced by an independent examiner. The handling rules are set out in If you did not preserve it, it did not happen.

How far to trust it

Metadata is a claim made by a machine that may have been set up wrongly, and by software that may have been told to lie.

• Clocks are wrong. Device clocks drift, are set to the wrong time zone or were never set at all.
• Fields are inherited. A document built from a colleague's template may name the colleague as author.
• Fields are editable. Anyone with free software can change an author name, a date or a GPS position.
• Fields are planted. We have seen leak samples with metadata deliberately crafted to implicate the wrong organization.

Where it helped

In The signature on file, lure documents sent to different companies carried the same authoring software build and the same reused template identifier, which helped link 38 lookalike domains to a single operation. In an extortion matter, the creation dates inside sample files predated the claimed intrusion by four years, which supported our finding that the data was recycled. In both cases, the metadata pointed the way and other evidence confirmed it.

Your own files

The same fields that help investigators help attackers. In the exposure assessments we have run since 2023, more than three quarters of organizations had documents on their own websites that revealed author names or internal usernames. Cleaning files before publication is cheap. We recommend that public document workflows remove author, organization, comment and revision fields by default, and that images are exported without location data.

Metadata checklist