Modified meta

[ywgast]

I have a pdf file that I suspect has been altered (metadata) as the created date in acrobat pro is missing in the document properties (among other suspicions).

I am looking for any created, modified, date meta that I might be able to extract from the file.

What is the best datetime command code to extract as much from a pdf as possible? (mac terminal)

[StarGeek]

You can use this to get a lot of info out of the file.
exiftool -g1 -a -s

If the Linearized tag is set to "No", make a copy of the pdf and then run this on the copy
exiftool -pdf-update:all=

Then run the first command and compare the output.

[Phil Harvey]

If the Linearized tag is set to "No", make a copy of the pdf and then run this on the copy
exiftool -pdf-update:all=

Then run the first command and compare the output.

Note that -pdf-update:all= will only have an effect if ExifTool was the software that altered the metadata.

To see as much of the PDF as possible, I add the -v3 option, but this output can be very lengthy and technical.

- Phil

[StarGeek]

Note that -pdf-update:all= will only have an effect if ExifTool was the software that altered the metadata.

Ah, good to know.

Never mind then

[ywgast]

Hey guys,

Thanks for the quick replies. I tried the v3 and got some info from the file; though, I don't think it's exactly what I was looking for. Long story short, there are before and after pictures taken on a phone of a document. The wording in the pictures is different but the file itself says it has never been modified....

Data from the v3 run...

  ExifToolVersion = 10.78
  FileName = ###########
  Directory = ###########
  FileSize = ##########
  FileModifyDate = 1517601407
  FileAccessDate = 1517771536
  FileInodeChangeDate = 1517603888

Then further down:

  | 1)  CreateDate = (D:20110912143113Z)
  |     - Tag 'CreationDate', direct object
  | 2)  Creator = (FrameMaker 10.0)
  |     - Tag 'Creator', direct object
  | 3)  ModifyDate = (D:20110912143329-06'00')


Something did catch my eye though.... The format of the create date and modify date are different. One is in Z time, and the modify date is in corrected time.

[StarGeek]

Something did catch my eye though.... The format of the create date and modify date are different. One is in Z time, and the modify date is in corrected time.

As the base times were only 2 minutes, 16 seconds apart, I would consider that more an error in how the data was written rather than indication of modification at a much later date.