- Nationwide Digital Forensic & Cyber Investigation Services
PDF metadata records who and what created a document and when. Forensic examiners compare the document properties, XMP packet, and document ID to build a timeline and detect edits, while knowing how easily each field can be changed.
Home › Digital Evidence Authentication › PDF Authentication › PDF Metadata and Document Properties
Quick Answer. PDF metadata is information stored inside a PDF about how and when it was made. It lives in two places: the Info dictionary, shown as Document Properties, and an embedded XMP packet. Key fields include Title, Author, Creator, Producer, creation and modification dates, and document and instance IDs. Examiners test whether these agree with each other and the claimed timeline.
This guide explains PDF metadata and document properties for forensic purposes. It is part of our PDF Authentication series. Metadata is powerful, but it is only one layer: findings are always tested against structure and revision history.
| Question | Short answer |
|---|---|
| Where is PDF metadata stored? | In the Info dictionary referenced by the trailer and in an XMP metadata stream referenced by the catalog. |
| What does Producer mean? | The library that wrote the PDF file. Creator is the application the content came from. |
| Can PDF metadata be edited? | Yes, easily. That is why examiners test it for internal consistency rather than trusting any single field. |
| What is the PDF document ID? | A pair of identifiers in the trailer. The first is set at creation; the second should change on modification. |
| Are PDF dates reliable? | Only when they agree with the XMP, document ID, structure, and outside records. Clocks and fields can be wrong or changed. |
| Does PDF 2.0 still use document properties? | PDF 2.0 deprecates the Info dictionary in favor of XMP, though many files still include both. |
The traditional PDF metadata dictionary holding Title, Author, Subject, Keywords, Creator, Producer, CreationDate, and ModDate.
Extensible Metadata Platform, an XML metadata standard (ISO 16684) embedded in PDFs and images.
The application in which the original content was authored, such as a word processor.
The software component that generated the PDF file itself.
XMP identifiers for the document across all versions and for one specific saved instance.
Dates written as D: followed by year, month, day, hour, minute, second, and an offset from UTC.
| Source | Key fields | Forensic value |
|---|---|---|
| Info dictionary | Title, Author, Subject, Keywords, Creator, Producer, CreationDate, ModDate | What most viewers display as Document Properties; easily edited |
| XMP packet | CreatorTool, Producer, CreateDate, ModifyDate, MetadataDate, DocumentID, InstanceID, History | Often more detailed; may record prior tools and saves |
| Trailer document ID | Permanent identifier and changing identifier | Shows whether the file was modified after creation |
| Embedded images and fonts | Image EXIF or XMP, font names and subsets | Can reveal original cameras, scanners, or authoring systems |
| Form fields and annotations | Field names, author names, timestamps on comments | Can identify reviewers, templates, and edit times |
We reconcile every metadata source in the file with structure and outside records. Tell us about the document and we will explain what the timeline can show.
Request Confidential Consultation Call (833) 292 3733PDF dates are written as D: followed by the year, month, day, hours, minutes, seconds, and an offset from UTC. A modification date after the date a document claims to represent can indicate later editing, but some systems regenerate documents on demand, so the date is compared with how the issuer normally produces files.
The trailer usually holds two identifiers. The first is created once and stays with the document. The second is meant to change whenever the file is modified and saved. When both parts match, the file is often unmodified since creation. When they differ, the file was saved again, and the examiner looks for what changed.
Some software records a history of actions in the XMP packet, listing tools, instance IDs, and times of each save. When present, it can show a chain of saves that conflicts with the claimed story, such as a statement opened and saved in a consumer editor after issuance.
| Inconsistency | What it can indicate |
|---|---|
| Info and XMP dates disagree | One source was updated or edited without the other |
| Producer differs from genuine issuer files | The file was rebuilt or saved by other software |
| Document ID parts differ | The file was modified after creation |
| ModDate earlier than CreationDate | Manual editing of fields or a clock problem |
| Time zone offset unusual for the issuer | The file was produced on a different computer or location |
| Author or Creator names a person or template | Manual authoring where a system output is expected |
Each inconsistency can have an innocent cause, which is why metadata findings are always tested against structure, revisions, and genuine reference documents.
| Attribute | Document Properties panel | Forensic metadata analysis |
|---|---|---|
| Info dictionary fields | Shown | Extracted with exact raw values |
| XMP packet and history | Partially or not shown | Fully parsed |
| Document ID pair | Not shown | Extracted and compared |
| Metadata in earlier revisions | Not shown | Recovered from incremental updates |
| Embedded image and font metadata | Not shown | Extracted and analyzed |
| Reliability assessment | None | Cross checked with structure and outside records |
Metadata analysis is performed on a preserved copy, because simply saving a PDF can change its metadata.
We extract and reconcile every metadata source in a PDF: the Info dictionary, the XMP packet and history, the trailer document ID, annotation data, and embedded image metadata, including metadata from earlier revisions. We compare it with genuine reference documents and outside records, build a defensible timeline, and explain what the metadata does and does not show in a report suitable for court. Our examiners are subject matter experts in PDF metadata analysis and routinely reconcile the Info dictionary, XMP packet, and file system dates against each other.
Elite Digital Forensics is an independent digital forensics practice serving attorneys, paralegals, in house counsel, insurers, lenders, businesses, and individuals nationwide. Our team includes former law enforcement forensic examiners and court qualified expert witnesses in computer, cell phone, cloud, document, and multimedia forensics. Every engagement begins with a scoped plan, hash verified evidence handling, and a clear explanation of what the examination can answer.
Most PDF readers show basic metadata in the Document Properties panel. Full metadata, including the XMP packet, document IDs, and earlier revision data, requires forensic extraction.
It can support a timeline but not prove it alone. Dates depend on computer clocks and can be edited, so they are tested against XMP data, document IDs, structure, and outside records.
Creator names the application where the content was authored, such as a word processor. Producer names the software that generated the PDF file.
The first value identifies the original document and the second is meant to change on modification. Different values usually mean the file was saved again after creation.
Yes. Metadata can be stripped or rewritten, and some systems write very little. Absence is compared with the issuer's normal output rather than treated as proof of tampering.
Usually. Saving can update the modification date, Producer, and document ID, which is why evidence should be preserved before it is opened in an editor.
Send us the details through our secure contact page. We will explain what the metadata can show and how the examination would be scoped. As court qualified experts in PDF metadata, we can explain a date conflict in a way a jury can follow.
Request Confidential Consultation Call (833) 292 3733This content is for educational and informational purposes only and does not constitute legal advice. Elite Digital Forensics provides independent digital forensic services and expert witness testimony; we do not provide legal representation. Every case is fact specific; outcomes depend on the evidence, jurisdiction, and counsel. Retain qualified legal counsel for advice about your matter.
Elite Digital Forensics Assistant
By submitting this form, you consent to be contacted by email, text, or phone. Your information is kept secure and confidential. Reply Stop to opt out at anytime.
IMPORTANT: Please remember to check your spam or junk folder