I have a pdf file that I suspect has been altered (metadata) as the created date in acrobat pro is missing in the document properties (among other suspicions).
I am looking for any created, modified, date meta that I might be able to extract from the file.
What is the best datetime command code to extract as much from a pdf as possible? (mac terminal)
You can use this to get a lot of info out of the file.
exiftool -g1 -a -s
If the Linearized tag is set to "No", make a copy of the pdf and then run this on the copy
exiftool -pdf-update:all=
Then run the first command and compare the output.
Quote from: StarGeek on February 04, 2018, 01:23:24 PM
If the Linearized tag is set to "No", make a copy of the pdf and then run this on the copy
exiftool -pdf-update:all=
Then run the first command and compare the output.
Note that
-pdf-update:all= will only have an effect if ExifTool was the software that altered the metadata.
To see as much of the PDF as possible, I add the
-v3 option, but this output can be very lengthy and technical.
- Phil
Quote from: Phil Harvey on February 04, 2018, 01:35:05 PM
Note that -pdf-update:all= will only have an effect if ExifTool was the software that altered the metadata.
Ah, good to know.
Never mind then
Hey guys,
Thanks for the quick replies. I tried the v3 and got some info from the file; though, I don't think it's exactly what I was looking for. Long story short, there are before and after pictures taken on a phone of a document. The wording in the pictures is different but the file itself says it has never been modified....
Data from the v3 run...
ExifToolVersion = 10.78
FileName = ###########
Directory = ###########
FileSize = ##########
FileModifyDate = 1517601407
FileAccessDate = 1517771536
FileInodeChangeDate = 1517603888
Then further down:
| 1) CreateDate = (D:20110912143113Z)
| - Tag 'CreationDate', direct object
| 2) Creator = (FrameMaker 10.0)
| - Tag 'Creator', direct object
| 3) ModifyDate = (D:20110912143329-06'00')
Something did catch my eye though.... The format of the create date and modify date are different. One is in Z time, and the modify date is in corrected time.
Quote from: ywgast on February 04, 2018, 02:41:11 PM
Something did catch my eye though.... The format of the create date and modify date are different. One is in Z time, and the modify date is in corrected time.
As the base times were only 2 minutes, 16 seconds apart, I would consider that more an error in how the data was written rather than indication of modification at a much later date.