Documents leak more than photos
A photo leaks where you were. A document leaks who you are and how you worked: author name, company, the app and version, the total minutes spent editing, revision identifiers that link separate files to the same session, and often comments and tracked changes you thought you accepted. A .docx is a ZIP file, and you can read all of it in about thirty seconds.
Open the box yourself
Office documents since 2007 are ZIP archives of XML. Duplicate a .docx, rename the copy to .zip, double-click it, and look inside.
docProps/core.xml holds dc:creator (whoever created the file), cp:lastModifiedBy (whoever touched it last, which is frequently a different person and a real surprise in a document sent as your own work), the creation and modification timestamps, and a revision counter.
docProps/app.xml is the one that reads like a timesheet. Company, Manager, the template the document came from, the exact application and version, page and word counts, and TotalTime: the accumulated minutes the document has been open for editing. A proposal that claims two weeks of work and records forty minutes of editing time tells its own story.
The parts nobody expects
- Revision save IDs.
word/settings.xmlcontains RSIDs, random identifiers Word assigns per editing session and attaches to the runs of text edited in that session. They are not secret and they are not personal on their own, but they link documents: two files sharing RSIDs were edited in the same session on the same machine. - Comments and tracked changes. Accepting changes in the view you are looking at does not always empty the underlying parts. Comments live in their own XML file, and deleted text can persist in the revision markup.
- Hidden rows, columns and sheets. In Excel these are a display setting, not a deletion. The pre-publication numbers are still in the file, and unhiding is one right-click.
- Formulas with absolute paths. A cell referencing another workbook can carry a full path such as a folder under
/Users/, which hands over your account name and your directory structure. - Embedded originals. A chart pasted from Excel can carry its whole source worksheet inside the presentation.
PDFs are not automatically safer
Exporting to PDF drops the ZIP structure but keeps a document information dictionary of its own: Title, Author, Subject, Keywords, Creator (the app that made the content), Producer (the app that wrote the PDF), plus creation and modification dates. Many PDFs also carry an XMP packet with a document ID that ties revisions together, exactly like the one in image files.
Two PDF-specific traps are worth naming.
Form data. A filled AcroForm or XFA form keeps its field values as data, separate from what is drawn on the page. Flattening the appearance does not necessarily remove the values, which is how tax and identity forms have leaked the exact numbers their authors thought they had printed away.
Failed redaction. Drawing a black rectangle over text hides it visually and changes nothing underneath. The text remains selectable, copyable and searchable. This has happened in court filings and newspaper exclusives repeatedly, and it will happen again this year, because the document looks correct on screen.
How to check on a Mac
| File | Check |
|---|---|
| Preview, then Tools, then Show Inspector. The (i) tab lists Title, Author, Creator and Producer. | |
| Word, Excel, PowerPoint | Duplicate it, rename to .zip, open docProps/core.xml and app.xml in any text editor. |
| Anything | mdls document.pdf in Terminal shows what Spotlight indexed, authors included. |
For the redaction trap specifically, open the PDF and try to select the text under the black box. If you can select it, it is still there.
Cleaning, and then checking
Office has a personal-information toggle and Acrobat has a sanitize command, and both are worth using. Neither removes everything, and neither tells you what it left. The reliable habit is to clean and then re-inspect the output with the methods above, because a document that reports clean in the app that produced it is the least trustworthy report available.
File cleaning is coming next to tdy.
tdy is a Mac menu-bar app that already tidies every link you copy. Stripping author names, revision IDs and document properties before you send a file is on the way. One email when it ships, nothing else.
Join the launch list