Authorship traces in PDFs and Office files

Contracts, offers, invoices, presentations: business documents are full of hidden information. Unlike photos, they rarely contain GPS coordinates — but they are often more revealing about internal processes and people.

Where the data lives

PDF

A PDF has two metadata homes:

• the Info dictionary: Title, Author, Subject, Keywords, Creator, Producer, CreationDate, ModificationDate.
• XMP metadata: an XML block that can repeat and extend the same fields, including editing tools and document IDs.

PDFs can also contain embedded files, form data and JavaScript — useful features that are worth checking before you send a file externally.

Office documents (DOCX, XLSX, PPTX)

Office files are ZIP archives. Inside, you find:

• docProps/core.xml — creator, last modified by, title, subject, keywords, revision number.
• docProps/app.xml — application and version, company, manager, template, editing time.
• docProps/custom.xml — custom properties added by your organization.

Because these files are ZIP containers, metadata can also hide in file names of internal parts, for example paths with user names.

What leaks in practice

• Who wrote it. dc:creator and cp:lastModifiedBy name individuals.
• Where they work. Company and Manager fields identify the organization and reporting lines.
• How often it changed. The revision counter and total editing time reveal negotiation rounds.
• Which tools were used. Application and version fields show your software stack — relevant for attackers looking for known vulnerabilities.
• Which template it came from. Template names sometimes include internal project codes.

Cleaning documents correctly

ShredHub rewrites the document properties instead of deleting the parts, so the file stays valid in Word, Excel and PowerPoint:

1. core.xml keeps only normalized timestamps.
2. app.xml keeps the application name but drops company, manager and template.
3. Custom properties are emptied.
4. Macros are not removed — ShredHub warns you instead, because removing them changes the file type and can break workflows. Remove macros in your editor if they are not needed.

For PDFs, ShredHub clears the Info dictionary, removes the XMP stream and strips JavaScript triggers, then verifies the result.

A habit worth building

Add a cleaning step to your document workflow — right before "send to external recipient". It takes seconds, works without special software, and prevents the small leaks that add up over time.