Restore Deleted Matadata from a PDF File

Restore Deleted Matadata from a PDF File
Restore Deleted Matadata from a PDF File
Restore Deleted Matadata from a PDF File
Restore Deleted Matadata from a PDF File
Restore Deleted Matadata from a PDF File

What is Metadata?

Metadata gives you important details about a document, like its name, who made it, when it was created, the device used, and the software used. This information helps us keep track of and find documents easily.

An example would be the information you find on the cover of a book. It tells you things like the book’s title, who wrote it, when it was made, and what it’s about.

Metadata

Read Metadata from a PDF File

If you would like to read metadata from a document or an image, you can use a CLI program called ExifTool.

” ExifTool is a free and open-source software program for reading, writing, and manipulating image, audio, video, and PDF metadata. “

https://en.wikipedia.org/wiki/ExifTool

o read the metadata of a PDF file using ExifTool, you can follow these steps:

  1. Install ExifTool: Download and install ExifTool from the official website (https://exiftool.org/). Follow the installation instructions for your specific operating system.
  2. Open a command prompt or terminal: Launch the command prompt or terminal on your computer.
  3. Navigate to the directory containing the ExifTool executable: Use the cd command to change to the directory where ExifTool is installed. For example, if it’s installed in the “C:\ExifTool” directory on Windows, use the command cd C:\ExifTool.
  4. Run the ExifTool command: With the command prompt or terminal open and the correct directory selected, you can read the metadata of a PDF file by running the following command:

exiftool <PDF filename>

exiftool sample.pdf

Sample.pdf outout

Note: ExifTool can extract metadata from various file types, not just PDFs. You can use the same command to read metadata from images, audio files, videos, and more.

[noptin-form id=5902]

Remove Metadata from a PDF File

You can remove metadata from a file using ExifTool, you can follow these steps:

  1. Install ExifTool: If you haven’t already, download and install ExifTool from the official website (https://exiftool.org/) following the installation instructions for your operating system.
  2. Open a command prompt or terminal: Launch the command prompt or terminal on your computer.
  3. Navigate to the directory containing the ExifTool executable: Use the cd command to change to the directory where ExifTool is installed. For example, if it’s installed in the “C:\ExifTool” directory on Windows, use the command cd C:\ExifTool.
  4. Run the ExifTool command to remove metadata: With the command prompt or terminal open and the correct directory selected, execute the following command to remove metadata from a file:

exiftool -all= <filename>

exiftool -all= Sample.pdf

This command removes all metadata from the file, including EXIF data, IPTC data, XMP data, and any other metadata types present in the file.

Output after removing the metadata

Restore deleted Metadata

The issue with the aforementioned approach for removing metadata from a file is its reversibility.

Consequently, anyone utilizing ExifTool to eliminate metadata from a file prior to emailing or uploading it online cannot ensure complete privacy, as this data may be recovered.

To recover deleted metadata, you can use the following option:

exiftool -pdf-update:all <filename>

exiftool -pdf-update:all Sample.pdf

The aforementioned command will recover all deleted metadata from a PDF file.

This command is specifically designed to work with PDF files and doesn’t work for images, audio files, and other file types.

Delete Metadata permanently

You might be wondering, “How can I protect myself from the retrieval of metadata?”

Well, there’s a solution to permanently delete metadata using a tool called qpdf.

Here’s what you can do:

  • Begin by following the method mentioned earlier using ExifTool to delete the metadata.

exiftool -all= <filename>

exiftool -all= Sample.pdf

Next, download qpdf.exe from https://sourceforge.net/projects/qpdf/ and save it to your computer.

Open the command prompt (cmd) and navigate to the location where you saved qpdf.exe.

Now, execute the following command to permanently delete the metadata and make it unrecoverable:

qpdf --linearize <stripped_exiftool.pdf> <new_filename.pdf>

qpdf --linearize Sample.pdf New_Sample.pdf

By using qpdf in this manner, you’ll ensure that the metadata is permanently removed and cannot be retrieved. This additional step adds an extra layer of protection to safeguard your privacy.

Restore Deleted Matadata from a PDF File [Video]

https://youtu.be/SGpxN8sRvMA
I hope you 👍 the video 😊

OSINT Links

Links to the websites are in CyberSudo’s OSINT Toolkit.

Get a Free Ethical Hacking Kit: https://bit.ly/438k4nS

  1. CyberSudo’s OSINT Toolkit
  2. 25% OSINT Masterclass Discount
  3. Hacking Radio Frequency mini-course
  4. Hacking Wi-Fi on OSX mini-course

OSINT Playlist https://bit.ly/3U3hoV0

Saad Sarraj

I am a CyberSecurity and Ethical Hacking/Penetration Testing passionate. I am also a TryHackMe Top 1% CTF Player.

Leave a Reply

Your email address will not be published. Required fields are marked *