Forensic Analyzer
Scan a PDF for identity leaks, tracking vectors, and security risks.
How to use Forensic Analyzer
- Drop a PDF into the analyzer. Scanning takes 1-5 seconds depending on file size and embedded image count.
- Read the risk badge: Critical (GPS, JavaScript), High (author PII, edit history), Medium (software fingerprints), Low (generic metadata).
- Expand each finding category to see raw field values. Author, Creator, Producer, and ModDate are the most common identity leaks.
- Check the EXIF section — embedded images may contain GPS coordinates, camera serial numbers, and timestamps independent of the PDF metadata.
- Use the direct links to the scrubber, flatten, or privacy pipeline to neutralize what was found. Run the analyzer again on the cleaned output to verify.
Tips
- The most common leak: Author field containing your Windows username or company email. This is set by Microsoft Office on every PDF export.
- GPS coordinates in embedded JPEG images are the highest-severity finding. A single photo with EXIF GPS can reveal your exact location.
- JavaScript in PDFs can phone home when opened. The analyzer flags this as critical because it enables tracking on document open.
- Run analyze → scrub → analyze as a verification loop. The second analysis should show zero or near-zero findings.
- Software fingerprints (Creator: Microsoft Word, Producer: LibreOffice) reveal what tools you used. This matters for source protection but is low-severity for most users.
Frequently asked questions
What does Forensic Analyzer change?
It parses the PDF Info Dictionary, XMP metadata, embedded image EXIF headers, and raw byte patterns. Findings are categorized by severity (critical, high, medium, low) and grouped by type (identity, location, tracking, structure).
Is Forensic Analyzer private by default?
Everything runs locally in your browser using pdf-lib for structure parsing and byte-level scanning for EXIF markers. No PDF bytes are uploaded or transmitted. The analyzer runs inside the same privacy boundary as all other tools.
What does Forensic Analyzer not protect?
It detects metadata and structural risks but does not analyze visible text content. A PDF with 'John Smith' written in the body text will not flag that as a finding — only metadata fields like Author, Creator, and EXIF tags are scanned.
Limitations
- Analysis is read-only. It does not modify the PDF in any way — use the scrubber for that.
- Encrypted or malformed PDFs fall back to byte-level pattern matching. Coverage is reduced but EXIF markers and JavaScript signatures are still detected.
- Printer tracking dots (Machine Identification Codes) are not detected in the current analyzer. Use the MIC decoder research tool for that — it requires high-resolution page rendering.
- The analyzer checks PDF metadata and embedded image EXIF. It does not analyze text content for PII (names, addresses in the visible text).