Learn

PDF metadata, explained

Every PDF carries a small ledger about itself: when it was created, when it was last changed, what software wrote it, and sometimes who the author was. This ledger is called metadata, and it's the first thing any examiner reads. It's also the most misunderstood evidence in document disputes, because every field in it can be edited, and most readers treat it as if it can't.

The fields and what they mean

The creation date records when this PDF file was generated, not when the underlying document was written. A contract drafted in January and exported to PDF in March carries a March creation date, and that's honest behavior. The modification date updates when the file is changed and re-saved. The producer field names the software that wrote the file's bytes, and the creator field names the application the content came from. A typical honest pairing looks like Word as creator and a Word PDF engine as producer.

There's a second, richer layer called XMP. Some tools write a document ID that survives edits, version counters, and a save history. When XMP is present, it can reveal a file that has lived far longer and traveled far wider than its two visible dates suggest. When it's absent from a document type that normally has it, that absence is itself a signal: something rebuilt this file.

How metadata lies

Three ways, in increasing order of effort. Tools rewrite it as a side effect: an online converter stamps its own name as producer and today's date as creation, erasing the true history without anyone intending fraud. People strip it: free utilities remove every field in one click, which is legitimate privacy hygiene and also exactly what someone laundering a document would do. And people forge it: the fields are plain data, and setting a chosen creation date is trivial for anyone who searches for how.

That's why the professional rule is: metadata generates questions, signatures answer them. A clean metadata story is consistent with an honest file and also consistent with a careful forgery. A broken or inconsistent metadata story is where examination starts, not where it ends.

Reading metadata like an examiner

Don't read fields in isolation. Read them against each other and against the document's claimed origin. A pay stub whose producer is a payroll platform, whose creation date matches the pay period, and whose file has no incremental updates tells one consistent story. The same pay stub with an online editor as producer, a creation date from last night, and three incremental updates tells a different one. Neither story is proof. One of them justifies a phone call.

FAQ

Does printing to PDF remove metadata?

It replaces it. Print-to-PDF renders a fresh file, so the new PDF carries the print driver as producer and the print moment as creation date. The original document's history doesn't transfer.

Can deleted metadata be recovered?

Sometimes partially. Incremental saves can leave earlier versions of the metadata inside the file, and XMP fragments can survive in objects the stripping tool didn't touch. A deep read of the file's internals finds what the visible properties panel doesn't show.

What metadata does a brand-new scan have?

A scan is an image wrapped in a fresh PDF, so it carries the scanner or scan app as producer and the scan time as creation. Scans have no edit history to read, which is why a "scanned copy" is a common way to present an altered document. The scan's own dates and source still have to make sense.