OSINT Jet · Document research

PDF Metadata OSINT: Who Made This Document, and When?

A PDF names one company on its cover and a different name in its Author field. You have found a discrepancy worth checking. You have not yet found the person who wrote it. The useful next move is to reconstruct how this particular file reached you.

PDF metadata is information stored alongside a document’s pages: names, software labels, dates and other descriptive fields. In OSINT, it can suggest a production history or expose an inconsistency. Its value comes from comparing those clues with the file’s source and contents, rather than treating a hidden field as an admission.

Start with the file’s journey

Write down the exact download URL, the page that linked to it and the time you retrieved it. Keep the original file untouched and inspect a working copy. A filename such as final-approved.pdf is a label someone chose; the word “approved” does not establish an approval process.

If a PDF arrived as an attachment, its immediate source is that message. If you later find a similar-looking PDF on a public website, preserve both. Do not silently replace the received version with the public one. The difference between them may be the very thing you need to explain.

Use an updated local reader for documents you are authorized to examine. You do not need to click embedded links or enable active features to read basic properties. Keep confidential files out of unfamiliar upload-and-analyze websites.

Read the fields as separate jobs

In Acrobat on Windows, open Menu → Document properties → Description; Additional Metadata exposes further fields when present. Interfaces vary by reader. Record the field’s actual label rather than forcing every value into an “author” column. Adobe documents both PDF properties and the ability to replace or append metadata. These values are useful clues, not immutable signatures.

Missing fields are also observations. Write “Author not present in the fields exposed by this reader,” not “anonymous author.” Another metadata container or reader might expose additional information. Empty metadata alone does not tell you whether it was removed deliberately.

A supplier document with three possible histories

Fictional training case: a brochure on workshop.example carries the brand “Workshop.” The embedded Author reads “Template Desk.” Its creation date is in February, but the brochure advertises a September service. You want to know whether Workshop issued this version.

Before searching the author label, write three explanations that could fit: Workshop reused an old template; a contractor produced the brochure; someone outside the business copied the branding. All three can explain the same metadata. Finding the words “Template Desk” elsewhere would not, by itself, choose between them.

Now seek evidence that separates the explanations. Does the company’s independently located website link to this exact file? Does a dated announcement describe the same offer? Does the received copy differ from the linked copy? For a consequential decision, can an established company contact confirm the version? Each check should reduce a specific uncertainty.

Suppose the official page links to a PDF with the same pages but a different offer expiry date. Your finding is a version mismatch. It is more useful to compare the disputed date and source than to turn the old Author label into an accusation. For the wider supplier question, continue with the vendor-quote verification guide.

Keep four clocks apart

A document may contain an embedded creation time, an embedded modification time, a date printed on its pages and your retrieval time. A publication page can add a fifth. Label them. A report dated September might have been assembled from a February template, exported in August and downloaded in October.

Preserve the original time string, including its offset. If one field says 2026-09-03 10:00 +02:00 and another says 2026-09-03 08:00Z, they describe the same instant. If no offset exists, do not invent one to make a timeline agree. Treat unexplained chronology as a question for the source, not a verdict.

Same appearance, different file

A file fingerprint can help answer a narrower question: are two saved copies byte-for-byte identical? In Windows PowerShell, Get-FileHash -Algorithm SHA256 -LiteralPath '.\public-note.pdf' calculates a fingerprint of that local file. Record the full result with the source note.

A different fingerprint establishes a byte difference, which might be a metadata edit, a changed page or another file-level change. It does not identify which change occurred. Matching page screenshots do not establish matching files; a matching fingerprint does not authenticate the publisher or make the contents true. Keep visual comparison and file comparison as different checks.

A provenance card you can hand to someone else

Question: Did the claimed publisher issue this version?
Source: download URL or original message; referring page
Retrieved: date, time and time zone
File: original name, size and SHA-256
Properties: exact fields, values and reader used
Page evidence: visible title, version, offer and printed date
Conflict: the one detail that needs explanation
Competing explanations: at least two plausible histories
Next source: the check that can distinguish those histories
Finding: what is established, and what remains open

Stop when the publication and version question has a supported answer. Searching every name hidden in a template can produce a long list of unrelated people without improving that answer.

When the unresolved issue connects a public document to a website, company and disputed claim, take the provenance card into an investigation brief. OSINT Jet’s AI-assisted case workflow is intended to organize clues and findings for review. This guide does not claim an automatic PDF-authentication feature. For a complex version dispute, describe the question for manual research; agree scope and cost before commissioning work.