Metadata Hygiene: Stripping EXIF, PDF and Office Before You Publish

An anonymous researcher published a 12-page PDF exposing corporate fraud. Within 48 hours, his name was on Twitter. It was not social engineering: it was the PDF Author field, auto-populated by LibreOffice, plus a modification timestamp that lined up with his working hours. Metadata is the Achilles heel of any sensitive publication, and most office suites embed identifying information by default without warning the user. This post walks format by format, with concrete commands, and ends in a reproducible clean-room flow and a pipeline that automates the mistake away for good.

Why metadata is the Achilles heel

Metadata is data about the file: who made it, with what software, when, where, and sometimes on what hardware. It is maintained for legitimate reasons, but to a deanonymizer it is a gift, because it is often more precise than the content itself. The Basilisk team treats metadata sanitization as a mandatory control before any public drop, on the same level as reviewing IPs and browser fingerprints. If you came from the practices in OPSEC for Security Researchers: Building a Personal Threat Model, you already know the technical part is the easy half and the discipline is the hard one.

EXIF in images

Start with the basics. A modern smartphone JPEG carries GPS coordinates accurate to 5 meters, device model, lens serial number, and even gyroscope orientation at the moment of capture. The standard tool remains Phil Harvey's ExifTool. For auditing, run exiftool -a -G1 -s file.jpg and you will see EXIF, XMP, IPTC, MakerNotes and ICC_Profile groups. For aggressive cleanup, exiftool -all= -overwrite_original *.jpg wipes everything, but keep an unedited backup outside your publishing directory, because you may still need the original for your own chain of evidence.

PNG and its text chunks

With PNG, the trouble is tEXt and zTXt chunks left by Photoshop or GIMP, often containing the username and full path of the source file - a path like C:\Users\first.last\Desktop deanonymizes instantly. The tIME chunk and embedded ICC profiles also carry information. exiftool cleans PNG too, but afterwards explicitly re-check with exiftool -a -G1 -s image.png that no software signature survived before you use the image.

PDF: three layers of metadata

PDF is the trickiest format because it carries metadata in three layers: the /Info dictionary, the XMP stream, and incremental object properties when the file was edited without linearizing. exiftool handles the first two, but for the third you need qpdf --linearize --object-streams=generate out.pdf in.pdf, which rewrites the entire structure and drops revision history. There is also the case of PDFs produced by corporate scanners: many embed the multifunction printer's serial number in the Producer field. If your document was printed and scanned, also consider the yellow tracking dots attack on laser printers, documented by the EFF and critical for anyone working in scenarios like Personal Security for High-Visibility Targets: Journalists, Activists, and Executives.

Office documents: a zoo of XML

DOCX, XLSX and PPTX are actually ZIP archives containing XML, and docProps/core.xml lists author, last modified by, revision and company. Word also maintains rsid (revision save IDs) that allow correlating text fragments across different documents from the same author, an attack known as rsid fingerprinting. For reliable cleanup, use Word's Inspect Document followed by Remove All, or LibreOffice File > Properties > Reset Properties combined with Tools > Options > Security > Remove personal information on saving. For batch automation, oxml-document-cleaner in Python or mat2 cover 95 percent of cases without opening a GUI.

mat2: the tool built for real threat models

mat2 deserves its own spotlight because it was built by people who think about real threat models, maintained by the Tails team. mat2 --inplace document.pdf works on more than 30 formats including SVG, MP4, FLAC and EPUB. The --check mode lists what is still left, and the --lightweight mode spares formats that do not survive a full re-encode. Combine it with torsocks if you upload via Tor, following the practice described in Real Anonymity with Tor: What Works and What is Myth in 2026.

Keeping JPEG clean: jpegtran vs ImageMagick

For images straight from a phone, consider converting through an intermediate format. Passing JPEG through ImageMagick with -strip removes ICC profiles and EXIF, but ImageMagick also reorders quantization bytes in an identifiable way, which can itself become a fingerprint. For serious cases prefer jpegtran -copy none, which preserves the original quantization table and strips metadata losslessly without re-encoding the image. The difference sounds academic, but it is exactly the kind of detail a forensic attribution hangs on.

Traps no tool catches

Screenshots from variable-refresh-rate monitors leave codec microartifacts that identify the GPU model. LaTeX-generated PDFs embed the hyperref package signature including the compilation date in UTC, leaking timezone. MP4 videos carry a moov atom with the creator filesystem timestamp. No automated tool reliably catches these semantic leaks - the only fix is to keep the creation environment itself neutral instead of cleaning up afterwards.

The Basilisk clean-room flow

For complete cleanup the flow is: produce content in a disposable VM with UTC timezone, export via clipboard or isolated network share, sanitize with mat2 on the host, validate with exiftool -a -G1 -s and only then publish. The same pattern appears in Digital Compartmentalization: Separate Identities Without Leaking Metadata and in Tails, Whonix or Qubes OS: Which to Pick for Each OPSEC Scenario. The core idea: identity leaks at the source, not only at upload.

Adversarial validation

Adversarial validation closes the loop. Before publishing, upload the final file to a public inspection service like metadata2go or run Didier Stevens' pdfid.py and pdf-parser.py. Compare the output with what you expect: ideally no authorship fields, timestamps zeroed or set to 1970-01-01, and no embedded streams beyond what is strictly necessary. Document the checklist and version it alongside the content, so a reviewer can reconstruct the state before the drop.

Automate instead of remembering

Metadata is not only a publishing problem: emails, Slack attachments and even uploads to public S3 buckets carry the same risk. Mature teams treat sanitization as a pipeline, not a manual step. Integrate mat2 into pre-commit hooks for repos that accept anonymous contributions and into upload gateways for whistleblowing platforms. Practical takeaway: build a shell alias called clean-doc that runs mat2 --inplace followed by exiftool -a -G1 -s on the result, and never publish anything without running that alias and reading the output.

Cleaning video and audio thoroughly

Images and documents are only half the story. An MP4 often carries, beside the moov atom, an encoder tag with the exact software and version, GPS in the udta container, and a creation timestamp in local time rather than UTC. The reliable route is ffmpeg -i in.mp4 -map_metadata -1 -c copy out.mp4, which strips all container metadata without re-encoding. Caution: -map_metadata -1 clears the container, but stream-level tags may remain, so verify with ffprobe -show_format -show_streams. In FLAC and MP3 the traces sit in Vorbis comments and ID3 tags respectively, which mat2 also clears. Watch out for embedded thumbnails too: many formats embed a small preview image with its own unsanitized EXIF, a back-door route to deanonymization. A PDF exported from a slide deck also frequently drags along embedded fonts carrying license and creator names.

The leak no tool sees: stylometry and rhythm

The most dangerous metadata is not in the file, it is in your behavior. Word choice, sentence structure, recurring typos and punctuation form a stylometric fingerprint that modern classifiers attribute to a known author with unsettling accuracy. Add rhythm to that: the hour you publish reveals your timezone more precisely than any EXIF timestamp, and a consistent pattern - never between 2 and 8am, quiet on weekends - narrows down location and profession. Countermeasures are tedious but real: neutralize a text's style before publishing or smooth it through translation round-trips, schedule posts with a delay across a wide time window, and discipline a distinct writing voice per identity. Metadata hygiene that stops at the file and ignores behavior is only half the job.

FAQ: Does a screenshot strip metadata?

Only partially. A screenshot does remove the original's EXIF and authorship fields, but it creates new metadata: the resolution and color space betray the display device, the screenshot tool writes its own software signature, and the filename often carries a timestamp and username. Treat the screenshot as a fresh artifact and run it through the same clean-doc alias before it leaves the system.

FAQ: Does metadata hygiene protect against a state?

No, and that honesty matters. Metadata hygiene will not protect you against a state-resourced adversary with access to carriers, endpoint compromise, or stylometry. But it eliminates the entire class of self-inflicted error that brings researchers down before the investigation even begins - and those banal mistakes are statistically the most common cause of deanonymization, not exotic cryptanalysis.

Conclusion: apply once, automate forever

Metadata hygiene is not a one-off task but a habit you pour into tools. Three seconds of discipline beat three years of litigation. Keep your clean-doc alias current, validate adversarially before every drop, keep the source of your documents neutral, and automate sanitization everywhere anonymous content flows. Apply once, automate forever - that is the whole trick.