A photo shows what is in it. A quotation as a Word file shows the text. That is one half. The other sits in fields no program displays of its own accord, but which anyone receiving the file can read out — and when sent by email, the file goes along unchanged.
Photos: the coordinates are the problem
Cameras and phones write a record called EXIF into every shot. The most interesting part of it is the coordinates, provided location services were on — and they often are on phones, because sorting by place needs them.
The practical cases are everyday and always the same:
- A photo of the bicycle being sold, taken in the yard. The coordinates are the home address.
- A receipt photographed at a desk and sent to a prospective employer.
- A holiday picture that reveals the exact place and the period during which the flat stood empty.
A second, less known point is the embedded preview. Some image editors keep the old preview image when cropping. Whatever was cut away is then still contained in the file — smaller, but readable.
Worth knowing: messaging services generally strip EXIF data on upload, because they re-encode the images anyway. Email does not. An attachment is passed on unchanged. Anyone used to "the image gets cleaned up anyway" is relying on a behaviour that does not exist here.
Documents: the field that gives away the origin
Office files carry a set of properties maintained automatically while editing. Two of them are regularly awkward.
"Last modified by" carries the name entered in the installation. A quotation the sales department sends out as "prepared individually" may well name the customer the same template was used for two weeks ago. An expert opinion meant to be independent names who commissioned it.
The template path often contains a username and an internal folder structure — information about the organisation and its naming scheme that a file going outside has no need to carry.
Then there are comments and tracked changes. They are not hidden, only not displayed: a recipient who switches the view on reads the internal discussion. The most common case is a discount considered internally and then struck out.
PDF: redacting is not the same as covering
PDF files add a fault of their own that gets demonstrated in public again and again: a black rectangle over a passage does not remove the text. It places a drawing over it. The text is still underneath, can be selected, copied and read out by any tool that extracts PDF text.
The same goes for white rectangles, for passages overwritten in white type, and for layers set to invisible.
Real redaction removes the content and replaces it. Programs capable of it call the function exactly that. Anyone who can only draw a rectangle has to re-render the page as an image afterwards — then the text really is gone, along with the ability to search it.
In addition, every PDF carries details of the producing program, creation and modification times, and often the original filename including its path.
How to remove it
| File type | Route |
|---|---|
| Photos, one at a time | right-click, Properties, “Remove Properties and Personal Information” — built into Windows |
| Photos, many | exiftool -all= *.jpg — removes every auxiliary field |
| Photos, quick and crude | take a screenshot of it. The copy has no capture data left. |
| Word, Excel, PowerPoint | File → Info → Check for Issues → Inspect Document |
| clean the document properties; for obscuring, use the real redaction function, not a rectangle |
A rule of thumb covering most of it: if the recipient needs the content but not the file, send a PDF instead of the original — and if they do not need the layout either, an image or plain text.
And in the other direction
The same fields are useful on receipt. A supposed invoice whose author names an entirely different company, or a photo whose capture time is two years before the alleged event, gives itself away in the properties — with no special tooling at all.
That attachments can also be dangerous for another reason, namely because they get executed, is covered in a separate article. The two views belong together: an attachment is never only what you see when you open it.