Skip to main content
J
James5CBF
Participant
August 25, 2020
Question

Help interpreting XMP metadata

  • August 25, 2020
  • 2 replies
  • 3068 views

I am examining a PDF document and trying to determine the *earliest* date it could have been created. The original document is lost and the copy has been passed around several times so the file system metadata is useless. Internally in the XMP metadata, there are no data for create/modify dates, but it does list the XMP Toolkit version:

x:xmptk="Adobe XMP Core 5.4-c006 80.159825, 2016/09/16-03:31:08 "

My question is simply this: When was this version released?  It looks like September 16, 2016 but I cannot confirm this anywhere.  I believe the version release date would establish the very earliest date the PDF could have been created.

Thanks to anyone who can help!

This topic has been closed for replies.

2 replies

T
Test Screen Name
Legend
August 25, 2020

1.  Nothing in a PDF except digital signatures with an outside certification has any forensic value. All of it is trivially easy to fake. 

2. For idle curiousity you could use an internal creation date.

3. A great many tasks, which many people consider entirely normal, will completely recreate one PDF from another, so the creation date proves nothing about the actual origin.

4. Adobe may well have been using an XMP version before its formal release date.

    J
    James5CBFAuthor
    Participant
    August 30, 2020

    Much appreciated!

    radzmar
    Community Expert
    radzmarCommunity Expert
    Community Expert
    August 25, 2020

    The XMP data can vary from file to file, since it depends on the appliacation used to create it, what information are stored into it. if any. So you can find date information in almost every of the subtrees. Most common is XMP Core and xmpMM:history.

     

     

      Terms & ConditionsAccessibility statement
      Using the community Terms of use Privacy Cookie preferences Do not sell or share my personal information ad choicesAdChoices