Removing metadata from PDF files using Exiftool and qpdf

This article describes how to view and modify metadata (which is data about data) in a file, but more specifically a PDF file.

Metadata

Use Exiftool to run the following command shows all the current metadata in the PDF file.

exiftool -all:all file.pdf

Removal of metadata from a PDF file can be considered as an anti-forensic technique to limit the information contained in the file about the creator. This helps reduce the footprint which limits the reconnaissance capability of the attacking party.

Removal of metadata

Exiftool makes use of an incremental update technique to edit metadata.

exiftool -Title="This is the Title" -Author="Happy Man" -Subject="PDF Metadata" file.pdf -overwrite_original

Exiftool can be used to remove all the metadata, in which case the metadata fields are replaced with nulls.

exiftool -all:all= CLEAN_file.pdf -overwrite_original

The main disadvantage of edits with Exiftool is that the edits are reversible. Some else can recover the metadata as they are actually never deleted, as follows

exiftool -pdf-update:all= ORIGINAL_file.pdf

Irreversible

After using the Exiftool for editing, the tool qpdf can be used to linearize the pdf file in order to remove all the old metadata (which were replaced by nulls) to make the edits with Exiftool irreversible.

The tool qpdf can be used to remove all unreferenced (old metadata) objects, that were removed with Exiftool to make it permanent This prevents that the tags cannot be restored.

qpdf --linearize in.pdf out.pdf

Optional: Exiftool can also be used to copy the metadata tags from one source file to another destination PDF file.

qpdf --linearize in.pdf out.pdf