A photograph can contain GPS coordinates. A PDF can contain the name of the person or computer that created it. A Word document may reveal its author, editing software, company name, and creation history. Even a video can contain information about the device, software, date, and encoding process used to create it.
All of this information is called metadata.
Metadata can provide useful clues when you are trying to decide whether an image, video, PDF, document, or email attachment is really what someone claims it is. In some cases, security researchers have even used metadata to connect malicious files to phishing campaigns and cybercriminal groups.
However, there is an important rule to remember:
Metadata is evidence. It is not proof.
Someone can change metadata. Software can overwrite it. Social media sites can remove it. A document template can carry metadata from an earlier author. Therefore, checking metadata should be one part of a larger verification process.
What Is Metadata?
Metadata simply means “data about data.”
A photograph might contain the camera model, lens type, exposure settings, GPS coordinates, and date taken. Apple confirms that location coordinates can be embedded in photographs and videos when Location Services are enabled.
A Microsoft Office document can contain information such as its title, author, subject, keywords, and other document properties. Microsoft specifically describes these document properties as metadata.
A PDF may contain an author, creator application, PDF producer, creation date, modification date, keywords, and other properties.
Videos may contain the recording device, dimensions, frame rate, duration, creation date, GPS information, encoder, and editing software.
Email has another form of metadata: its headers. Email headers can reveal mail servers, sender information, message routing, and technical details that are not normally visible when reading the message. Microsoft notes that reviewing headers can help identify cases where someone has spoofed a sender address.
Taken together, those clues can tell a much larger story than the filename alone.
First Rule: Do Not Open a Suspicious File Just to Investigate It
If an unexpected attachment arrives from someone you do not know, do not double-click it simply because you want to inspect it.
You can often investigate the file without executing its contents.
Save the file without opening it. Then inspect its operating-system properties, scan it with security software, calculate its hash if necessary, and use a metadata reader.
For highly suspicious Word, Excel, PowerPoint, or executable files, an experienced user should analyze a copy in an isolated environment rather than on a production computer.
This matters because metadata investigation is supposed to reduce your risk, not accidentally trigger the attack you are investigating.
How to Check Metadata on Windows
Windows provides a basic metadata viewer directly in File Explorer.
Find the file, right-click it, select Properties, and then open the Details tab.
The information available depends on the file type. Photographs may show camera information and GPS-related fields. Videos can show resolution, frame rate, length, and encoding details. Documents can show authorship and creation information.
For Microsoft Office files, open the document only if you already trust it. Then go to File > Info > Properties > Advanced Properties. Microsoft Office can display document properties such as author, title, subject, and keywords.
For suspicious email in the new Outlook for Windows, select More actions > View > View message details. In classic Outlook, open the message and select File > Properties to view the Internet headers.
Advanced Windows Check: Calculate the File Hash
PowerShell can calculate a SHA-256 hash without opening the file:
Get-FileHash "C:\path\to\file.pdf" -Algorithm SHA256
A hash acts like a digital fingerprint of the file’s contents. Microsoft explains that changing even a single character in a file changes its hash.
A hash does not tell you whether the file is safe. However, it lets you compare your copy with a known legitimate copy or a hash published by a trusted security source.
How to Check Metadata on a Mac
macOS also exposes substantial metadata without requiring additional software.
Open Finder and select the file. Choose View > Show Preview if the Preview pane is hidden.
Apple says Finder’s Preview pane can display metadata including document creation dates and camera or lens information.
You can also select a file and choose File > Get Info.
For images and PDFs, open the file in Preview and use the Inspector. Preview can display information including author details, image resolution, keywords, and location information when available.
Photos provides even more information for images and videos. Select an item and press Command-I. Depending on the media, Photos may display the capture device, date, camera settings, and location.
For suspicious email in Apple Mail, select View > Message > All Headers.
Advanced Mac Check: Calculate a Hash
Terminal can calculate a SHA-256 hash with:
shasum -a 256 "/path/to/file.pdf"
Again, the hash becomes useful when you have something trustworthy to compare it against.
Go Deeper With ExifTool
For advanced metadata inspection on either Windows or macOS, one of the most useful tools is ExifTool.
Despite its name, ExifTool handles far more than photograph EXIF data. It supports a large range of image, video, archive, document, and other file formats.
A useful command is:
exiftool -a -G1 -s filename
That asks ExifTool to display detailed metadata and identify the metadata groups where the information was found.
Look for inconsistencies.
A photograph supposedly taken yesterday might contain a creation date from three years ago. A PDF supposedly created by a government agency might list an unexpected author. An “original” photograph might list Adobe Photoshop as its software. A video supposedly recorded on a phone might identify desktop editing software as its encoder.
None of those findings automatically prove fraud. They do give you a reason to investigate further.
Advanced Document Inspection
Modern Word, Excel, and PowerPoint files can contain far more than visible text.
Formats such as .docx, .xlsx, and .pptx use the Office Open XML format. Technically, these files are packages containing XML files and other resources.
Advanced investigators can make a copy of the file, change the extension to .zip, and examine internal directories such as docProps.
Files such as core.xml and app.xml can reveal document properties that may not be obvious from the visible document.
Macro-enabled and older Microsoft Office documents require greater caution.
The free oletools project contains utilities specifically designed for analyzing Microsoft Office files. It can extract document metadata, examine VBA macros, identify embedded objects, inspect timestamps, and detect several techniques commonly found in malicious documents.
Seven Metadata Red Flags Worth Investigating
- A supposed original photo contains unexpected editing software.
- GPS coordinates conflict with the sender’s story.
- Creation dates occur after the claimed publication date.
- A government or corporate document lists an unrelated individual as its author.
- The “Company” or custom-property fields contain unusual commands, URLs, or code.
- The file extension does not match the actual file format.
- Several supposedly unrelated suspicious documents contain identical unusual metadata.
One red flag rarely proves deception. Several independent inconsistencies deserve attention.
Case Study 1: Phishing PDFs With a Repeating Author
Security researchers at Proofpoint investigated a financially motivated threat actor known as TA4903.
The group impersonated U.S. government agencies and private businesses. Its campaigns included PDF attachments containing links or QR codes that led victims to credential-stealing websites.
Proofpoint found something interesting inside the PDFs.
The documents frequently shared a metadata characteristic: the author name Edward Ambakederemo.
The author name alone did not prove that a specific PDF was malicious. However, combined with suspicious sender domains, cloned government websites, repeated document designs, and phishing infrastructure, it became another useful indicator.
Proofpoint later observed credentials captured through these campaigns being used to access email accounts and search for terms related to payments, banking, and merchant information.
A careful recipient who found suspicious authorship metadata could have stopped before following the PDF link or QR code and independently contacted the organization.
Free tool: ExifTool can expose PDF metadata without requiring the document to be opened normally.
Paid solution: Adobe Acrobat Pro currently costs US$19.99 per month on an annual plan in the United States. It includes advanced PDF security tools, including sanitization that can remove metadata, scripts, embedded content, and other hidden information.
Case Study 2: Malware Hidden Inside Document Metadata
Metadata itself can sometimes become part of an attack.
Palo Alto Networks’ Unit 42 researchers investigated the RANCOR campaign, which targeted organizations in Southeast Asia.
Researchers discovered a malicious Excel document where the attackers placed important malicious code inside a document metadata property. The macro inside the spreadsheet could retrieve information from that property and use it during the attack.
That is an important lesson.
Most people think metadata can only contain harmless information such as an author’s name or creation date. Attackers can abuse obscure properties too.
If a document contains strange commands, URLs, executable instructions, or encoded data in fields where a company name or normal description should appear, do not enable macros or continue opening the document.
Free tool: oletools can inspect Office metadata and analyze VBA, Excel macros, embedded objects, and other suspicious structures.
Reasonably priced security solution: Bitdefender Antivirus Plus currently lists at US$29.99 for three devices, while Total Security lists at US$59.99 for five devices. Endpoint security does not replace metadata inspection, but it adds another defense before malicious documents execute.
Case Study 3: A Photograph That Revealed a Location
Metadata can expose the person sending or publishing a file too.
In 2012, VICE published a photograph while reporting on antivirus entrepreneur John McAfee, who was attempting to conceal his location.
The original photograph contained GPS information in its EXIF metadata that identified a location in Guatemala. VICE later acknowledged that the metadata leak was real.
This was not a corporate data breach. It was an operational-security and privacy failure. However, the lesson applies directly to individuals, companies, journalists, law enforcement, military personnel, domestic-abuse victims, and anyone handling sensitive location information.
Before sending an “innocent” photograph, inspect it.
Free tool: ExifTool can display GPS coordinates and other EXIF information.
Paid Mac option: MetaImage Unlimited currently sells for US$29.99 and provides extensive EXIF, IPTC, XMP, GPS, and other metadata controls.
Windows users can also use the free Exif Pilot for individual files. Its optional batch-processing plug-in currently costs €79.95.
Why Metadata Cannot Prove a File Is Original
This is where metadata investigations often go wrong.
Anyone with the right software can change many metadata fields. GPS coordinates can be replaced. Dates can be modified. Authors can be renamed. Editing software can remove old metadata and create new metadata.
Some websites and messaging services also remove metadata when files are uploaded or compressed.
Therefore, missing metadata does not automatically mean a file is fake.
Likewise, convincing metadata does not automatically make it genuine.
A better approach is to compare several independent signals: metadata, email headers, the sender’s domain, file hashes, digital signatures, the visual content, reverse-image searches, known versions of the file, and direct confirmation from the supposed sender.
Newer provenance systems can provide stronger evidence than ordinary EXIF fields. The C2PA Content Credentials standard, for example, uses cryptographically signed provenance information and hashes to make tampering detectable. However, C2PA itself emphasizes that provenance information should help people evaluate content rather than automatically declare something “good” or “bad.”
A Better Rule: Verify the Story Around the File
Imagine someone emails you an invoice.
The sender name looks correct.
Instead of opening the attachment immediately, inspect the message headers. Check the real sending domain. Save the attachment without opening it. Examine its metadata. Check the author and creation software. Calculate its hash if you have a trusted original for comparison.
Then call the sender using a phone number you already know.
Each individual test may tell you very little.
Together, they can expose a scam.
Metadata works best when you treat it as another witness in the investigation, not as the judge delivering the final verdict.
FAQ
Not by itself. Metadata may reveal editing software, unexpected dates, GPS coordinates, or camera information that conflicts with a claim. However, metadata can also be modified or removed.
Yes. Many applications allow users to edit EXIF fields, including dates, camera information, GPS coordinates, descriptions, and copyright information.
Usually not. Creating a screenshot creates a new image file with its own properties. Important metadata from the original image may disappear.
Yes. Depending on the device and recording settings, videos can include location, recording time, device information, encoding software, and other metadata.
Normally, reading metadata with a dedicated tool such as ExifTool is much safer than opening the file in the application associated with it. However, suspicious files should still be handled cautiously. Do not enable macros, scripts, editing functions, or active content simply to investigate a file.
Sometimes. Removing GPS data from personal photographs can protect your location. Businesses may also want to remove document-author information, comments, revision data, or internal software details before publishing files. Keep an untouched original somewhere secure before changing anything.
Before You Click, Check
Scammers depend on speed, trust, and distraction.
Metadata gives you another reason to slow the process down.
A strange author name, impossible timestamp, hidden GPS coordinate, unexpected editing application, suspicious company field, or mismatched email header may be the clue that tells you something is wrong.
Do not rely on metadata alone. Instead, combine it with sender verification, security scanning, file hashes, domain checks, and common sense.
If a file still does not make sense after those checks, do not open it. Verify it with the sender or ask a trusted IT or cybersecurity professional such as SofTouch Systems to examine it first.
Discover more from SofTouch Systems
Subscribe to get the latest posts sent to your email.