Document Metadata

Learning Objectives

• After this, students can locate an organization’s published documents with search dorks.
• After this, students can extract and interpret metadata from documents using exiftool.
• After this, students can explain what document metadata reveals about an organization’s internal environment.
• After this, students can sanitize documents to remove metadata (the defender’s job).

Why Documents Leak So Much

Every PDF, Word file, spreadsheet, and slide deck an organization publishes was created inside that organization, on real machines, by real people, using real software — and the file quietly records traces of all of it. A public brochure looks harmless, but its metadata can name the employee who wrote it, the internal username on their workstation, the exact software version (a patching hint), the network path where it was stored, and even the office printer it was scanned on. Collect a handful of documents and you can start reconstructing usernames, naming conventions, and the software estate — the raw material for phishing and for targeting known-vulnerable software versions.

This technique pairs tightly with dorking (4.1-search-engine-dorking.md, which finds the files) and feeds directly into methodology (Module 3) and defense (Module 9).

Step 1: Find the Documents

Use search operators to enumerate what a domain has published. Framed for companyx.com, an authorized target:

site:companyx.com filetype:pdf
site:companyx.com (filetype:doc OR filetype:docx)
site:companyx.com (filetype:xls OR filetype:xlsx)
site:companyx.com (filetype:ppt OR filetype:pptx)

Run the same queries on Bing as well — its index differs. Also check the Wayback Machine (see 4.5-infrastructure-recon.md) for documents that were published and later removed; “deleted” rarely means gone.

Download only from a domain you are authorized to assess. Pulling a batch of documents off an arbitrary third party can breach their terms of service and, depending on content, the law (Module 2).

Step 2: Extract the Metadata

exiftool (the reliable core tool)

exiftool reads metadata from images and from PDFs and Microsoft Office files, which makes it the one tool to reach for first.

Read everything, grouped by category:

exiftool -G report.pdf

Pull the fields that matter most for OSINT — author, creator/producer software, and timestamps:

exiftool -Author -Creator -Producer -CreateDate -ModifyDate report.pdf

Process a whole folder of downloaded documents into a spreadsheet for review:

exiftool -r -csv -Author -Creator -Producer -CreateDate ./docs/ > docs-metadata.csv

Show duplicate/unknown tags too, in case something useful is hiding:

exiftool -a -u -G report.docx

Modern Office files (.docx, .xlsx, .pptx) are really ZIP archives of XML. exiftool reads their core properties, but you can also unzip one (unzip -l report.docx) and read docProps/core.xml and docProps/app.xml directly to see authors, the editing application, and revision data.

metagoofil (finds and downloads at scale)

metagoofil automates step 1 — it searches for an organization’s public files and downloads them for you — but note an important change: the current maintained fork no longer analyzes metadata itself. By design it defers extraction to exiftool. So the modern workflow is metagoofil to gather, exiftool to analyze.

On Kali it’s a packaged tool:

metagoofil -d companyx.com -t pdf,docx,xlsx -l 100 -n 25 -o ./companyx-docs -w

Then analyze what it pulled:

exiftool -r -csv -Author -Creator -Producer ./companyx-docs/ > companyx-metadata.csv

FOCA (Windows, GUI, still maintained)

FOCA (Fingerprinting Organizations with Collected Archives) is a classic Windows GUI tool that searches Google/Bing/DuckDuckGo for a domain’s documents, downloads them, extracts metadata, and correlates it into a picture of users, software, and servers. It is still maintained (a 2025 release exists), but it is heavier to set up: Windows 64-bit, .NET Framework, and a SQL Server instance. For a Linux-based class the metagoofil + exiftool combo is lighter; mention FOCA as the GUI alternative students may meet on Windows engagements.

Step 3: Interpret What You Find

Metadata is only useful once you turn fields into inferences. Common high-value fields:

Look for patterns across many documents, not one field in one file. If ten documents show authors j.smith, a.jones, r.kettle, you’ve likely learned the username convention (first-initial.last) — which tells you how to guess other employees’ usernames and email addresses. That inference is the payoff, and it’s the same reasoning defenders must anticipate.

Step 4: Sanitize (the Defender’s Job)

Because this is an ethical-hacking class, always close the loop with the fix. Removing metadata before publishing is cheap and effective.

Strip all metadata with exiftool (keeps a *_original backup unless you tell it not to):

exiftool -all= brochure.pdf
exiftool -all= -overwrite_original brochure.pdf

exiftool -all= -overwrite_original -r ./to-publish/

Organizational guidance for Module 9: build metadata-stripping into the publishing pipeline, use the “Inspect Document” / “Remove Personal Information” features in Office and the “Sanitize Document” feature in Acrobat, and train staff that the file, not just its visible content, goes out the door. Verify by re-running exiftool after stripping.

Key Terms

• Metadata: data embedded in a file describing how, when, by whom, and with what it was made.
• Author / Last Modified By: Office/PDF fields that frequently expose real names and internal usernames.
• Producer / Creator: fields naming the software (and version) that generated a file.
• Sanitizing: removing metadata before a file is published.
• FOCA: a Windows GUI tool that finds documents and correlates their metadata.

Key Takeaways

• Every published document carries traces of the person, machine, and software that made it.
• Workflow: dork/metagoofil to gather documents, exiftool to analyze them.
• The modern metagoofil no longer extracts metadata — it hands off to exiftool.
• Patterns across many files reveal username conventions, software versions, and internal paths.
• exiftool -all= -overwrite_original file sanitizes a document; bake this into any publishing pipeline.
• The attacker’s collection technique is also the defender’s checklist.

References

• ExifTool by Phil Harvey — official site
• ExifTool application documentation (options)
• metagoofil — opsdisk (GitHub)
• metagoofil — Kali Tools
• FOCA — ElevenPaths (GitHub)