I have a PDF file which, when going via "Properties", shows no data. For example, no mention of the author of the file. Is there any way I can unlock such information?
No data mean there are no data, sorry.
Unfortunely, populating metas is at all a good practice, but not a requirement.
You could create a PDF from approx every program able to print something, so there are as many different pdf maker than applications.
But, you could split (source) your PDF, (with pdftk, ghostscript, pdfdetach and a lot of other tools) then inspect each components.
This could become a forensic job, but you could determine a lot of thing by this kind of work.
printf "%%\041\n/Helvetica findfont\n11 scalefont\nsetfont\nnewpath\n 300 500 moveto\n(%s) show\nshowpage\n" TEST | gs -sDEVICE=pdfwrite -sOutputFile=/tmp/test.pdf - -c quit
This will produce some regular PDF file, containing only the word
Well, If you wish to see metadata of the
You can use pdftk. If you don't know about pdftk tool, Here is a line from it's manual
If PDF is electronic paper, then pdftk is an electronic staple-remover, hole-punch, binder, secret-decoder-ring, and X-Ray-glasses. Pdftk is a simple tool for doing everyday things with PDF documents.
Coming to your Question, pdftk also supports Data Dumps. So, here is your answer.
pdftk (If not installed) :
sudo apt-get install pdftk
Then execute command :
pdftk "pdf_file_to_investigate" dump_data
It wil show data in form of InfoKey & InfoValue where
Infokey stores the type of Information and
Infovalue stores the information itself.
I need to make two points here :
I. Command outputs information to STDOUT. So, If information is too much, you will be out of screen on terminal. A better way would be to save contents and later on watch it using
cat command. For that you can do this :
pdftk "pdf_file_to_investigate" dump_data > "pdfinfo_file_name.txt"
cat "pdfinfo_file_name.txt" | more
II. You can add utf8 at the end of data_dump if not working fine. It's just the encoding Scheme of output and IS wise to use. For that you can do this :
pdftk "pdf_file_to_investigate" dump_data_utf8 > "pdfinfo_file_name.txt"
- The metadata can be erased or manipulated easily on a PDF.
- If you're just trying to read the meta there is always the good old PDF Meta 1.0
- I use pdftk for most things but it has yet to show me any additional data that Pdf Meta doesn't.
Depending on the PDF you can go deeper, like let's say pdf contains scanned image files, you can inspect it using paid forensic software to see if the pixels have been altered on the image or potentially identify the Scanner/Copier model used to generate it.