Metadata Forensic Traces

PDF risk includes both explicit metadata fields and structural remnants from document lifecycle operations.

Trace categories

• Document info dictionary fields.
• XMP metadata streams and mirrored values.
• Annotations, forms, actions, and embedded names trees.
• Incremental-update residue from repeated edits.

Defensive handling

• Rebuild outputs to avoid preserving incremental baggage.
• Normalize time fields when operationally appropriate.
• Remove interactive layers not required for final evidence use.

What this does not protect

• Content-level identifiers in visible text or imagery.
• External system logs correlated to delivery events.
• Source-file metadata outside the final exported PDF.

Next safe steps

• Read /scrub and inspect scrub report hashes.
• Read /blog/documents/what-metadata-is-and-why-it-matters.