What is an Adobe XMP Metadata Packet?
Introduced by Adobe, the Extensible Metadata Platform (XMP) embeds structured XML data directly inside document streams using the W3C Resource Description Framework (RDF) standard.
Unlike the simple key-value pairs of the traditional PDF Info dictionary, XMP packets store rich hierarchies, including Dublin Core schemas, unique Document IDs, and full editing session histories.
Clearing the basic PDF Info dictionary is insufficient if the embedded XMP XML packet remains inside the Document Catalog.
Dublin Core and Adobe Schema Elements that Leak Identity
High-risk elements frequently recovered during forensic audits include:
- dc:creator: Full name or corporate email of the document creator.
- xmpMM:DocumentID: A persistent UUID that correlates different document drafts.
- xmp:CreatorTool: Specific software build, operating system, and patch version.
- pdf:Producer: The underlying PDF library and compilation environment.
Extracting and Inspecting XMP Streams
Forensic investigators locate XMP packets by searching for the <?xpacket begin= processing instruction or resolving the /Metadata indirect object from the PDF Catalog dictionary.
Because XMP is stored as plaintext XML, it can often be extracted even from damaged or partially encrypted PDF files using raw binary string carvers.
Permanent Deletion of the Catalog /Metadata Stream
To completely neutralize tracking risk, the sanitizer dereferences the /Metadata pointer from the Catalog dictionary and removes the corresponding object stream from the cross-reference table.
OverlayCheck performs this operation entirely within browser memory, producing a verified clean PDF binary.