PDF metadata and hidden text: what “redacted” documents still contain

A black rectangle in Preview is a drawing command. It is not deletion. The original text operators can still sit in the content stream at the same coordinates, sometimes with white fill (1 1 1 rg), sometimes simply underneath the box. Copy-paste into Notepad, a screen reader, or pdftotext will still speak “$184,000” if that string was never removed.

Incremental saves

PDF allows appending a new body and xref after an existing %%EOF. Viewers show the latest objects. The previous generation is still in the bytes. A “final” brief with three EOF markers is a file that still contains draft one and draft two. Counsel has been embarrassed by this in discovery. PDF X-Ray counts those markers and flags leftover generations.

Metadata and JPEGs

Document Info and XMP can still say Author: “mchen”, Title: “layoff-list-v3.pdf”, Creator: “Microsoft Word”. That is not the body of the letter; it is the envelope. Embedded JPEGs can still carry EXIF GPS from the phone that photographed the badge. X-Ray lists identity fields and GPS when they are present.

Attachments (/EmbeddedFiles) are another pocket. A “clean” one-page PDF can carry a spreadsheet. JavaScript and open actions are uncommon in office files and worth treating as hostile if you did not add them.

What to do instead of a black box

Use a redaction tool that removes the content stream and then writes a new file. Then X-Ray the output. Compress at High flattens pages to images — useful for a casual visual-only copy, not a records-office workflow. X-Ray itself does not strip anything. It is the second pair of eyes, on your machine, so the secrets are not sent to a scanner in the cloud in order to find out whether they leaked.