1

I have a PDF file which, when going via "Properties", shows no data. For example, no mention of the author of the file. Is there any way I can unlock such information?

3
  • 4
    you are assuming there is data to show
    – schroeder
    Dec 6 '17 at 22:55
  • 1
    Yes, that sort of data can be stripped off of the file, so it may not exist. It's also possible you don't have permission to view that data. In windows/NTFS I believe that is the "Read Attributes" under advanced permissions.
    – K.B.
    Dec 6 '17 at 23:05
  • To check if the metadata even exists, use a hexeditor and look for relevant details in the ASCII corresponding to the raw hex of the PDF.
    – whoami
    Dec 6 '17 at 23:30
1

No data mean there are no data, sorry.

Unfortunely, populating metas is at all a good practice, but not a requirement.

You could create a PDF from approx every program able to print something, so there are as many different pdf maker than applications.

But, you could split (source) your PDF, (with pdftk, ghostscript, pdfdetach and a lot of other tools) then inspect each components.

This could become a forensic job, but you could determine a lot of thing by this kind of work.

Little sample:

printf "%%\041\n/Helvetica findfont\n11 scalefont\nsetfont\nnewpath\n
             300 500 moveto\n(%s) show\nshowpage\n" TEST |
    gs -sDEVICE=pdfwrite -sOutputFile=/tmp/test.pdf - -c quit

This will produce some regular PDF file, containing only the word TEST...

pdfinfo /tmp/test.pdf
Producer:       GPL Ghostscript 9.20
CreationDate:   Fri Dec  8 17:46:00 2017 CET
ModDate:        Fri Dec  8 17:46:00 2017 CET
Tagged:         no
UserProperties: no
Suspects:       no
Form:           none
JavaScript:     no
Pages:          1
Encrypted:      no
Page size:      595 x 842 pts (A4)
Page rot:       0
File size:      2569 bytes
Optimized:      no
PDF version:    1.5
0

Well, If you wish to see metadata of the .pdf file, such as Author, Creation Date, Modified Date, Size, BookMarkID, etc.

You can use pdftk. If you don't know about pdftk tool, Here is a line from it's manual

If PDF is electronic paper, then pdftk is an electronic staple-remover, hole-punch, binder, secret-decoder-ring, and X-Ray-glasses. Pdftk is a simple tool for doing everyday things with PDF documents.

Coming to your Question, pdftk also supports Data Dumps. So, here is your answer.

Install pdftk (If not installed) :

sudo apt-get install pdftk

Then execute command :

pdftk "pdf_file_to_investigate" dump_data

It wil show data in form of InfoKey & InfoValue where Infokey stores the type of Information and Infovalue stores the information itself.

See this for an example

I need to make two points here :

I. Command outputs information to STDOUT. So, If information is too much, you will be out of screen on terminal. A better way would be to save contents and later on watch it using cat command. For that you can do this :

pdftk "pdf_file_to_investigate" dump_data > "pdfinfo_file_name.txt"

cat "pdfinfo_file_name.txt" | more

II. You can add utf8 at the end of data_dump if not working fine. It's just the encoding Scheme of output and IS wise to use. For that you can do this :

pdftk "pdf_file_to_investigate" dump_data_utf8 > "pdfinfo_file_name.txt"

0
  1. The metadata can be erased or manipulated easily on a PDF.
  2. If you're just trying to read the meta there is always the good old PDF Meta 1.0
  3. I use pdftk for most things but it has yet to show me any additional data that Pdf Meta doesn't.

Depending on the PDF you can go deeper, like let's say pdf contains scanned image files, you can inspect it using paid forensic software to see if the pixels have been altered on the image or potentially identify the Scanner/Copier model used to generate it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.