File / Document: Data Point Intelligence Guide

Every file carries more than its content. The container, the metadata and the structure record how it was made and by whom, and that record is usually more revealing than the document itself.

Understanding the File / Document as an intelligence artifact

A file or document is the container artifact of an investigation: a malware sample, a leaked spreadsheet, a phishing attachment, a photograph, a PDF exhibit. Analytically it is three layers at once. The content is what a human reads. The structure is the format's internal organisation, such as PDF object trees, OOXML part relationships or PE sections. The metadata is what the creating software recorded automatically, including authorship, timestamps, editing history, software versions and, for media, device and location data.

Format determines what is recoverable. Office OOXML files are ZIP archives whose parts retain revision identifiers, template paths and embedded objects. PDFs keep incremental update history, so earlier versions of redacted or edited content frequently survive. JPEGs carry EXIF, IPTC and XMP blocks with device and GPS data. Archives preserve original path structure and per-entry timestamps that reveal how the collection was assembled.

Why it matters

Files are where document exploitation, malware analysis and leak investigation converge. A single attachment can yield a hash for repository lookup, an author name for identity work, a template path exposing an internal network share, an embedded macro revealing capability, and timestamps that anchor a timeline. In leak analysis, metadata across a corpus reveals the collection's provenance and internal consistency, which is often the fastest way to test whether a purported leak is genuine.

What analysts actually look for

These are the concrete, observable signals that carry weight in this area of work:

Author, last-modified-by and company metadata fields, which name individuals and organisations that touched the document.
Creation, modification and print timestamps with their timezone offsets, which place authoring activity in a working day and region.
Software and version strings, which fingerprint the creating environment and can tie unrelated documents to one workstation.
Template and linked file paths, which frequently expose internal server names, user directories and network share structures.
Embedded and previously deleted content recoverable from incremental updates, revision identifiers or unreferenced objects.
EXIF and XMP media metadata including device model, serial number, lens, GPS coordinates and capture timestamps.
Structural anomalies such as unusual object streams, embedded executables, remote template references or malformed headers indicating weaponisation.
Language, locale, keyboard and codepage indicators recorded by the authoring application rather than chosen by the author.

Where the data comes from

Authoritative and openly available collection points. Always confirm licensing and terms before operational or commercial use:

ExifTool — Comprehensive metadata extraction across image, document, video and archive formats with format-specific field detail
VirusTotal — Reputation, structural parsing and behavioural reporting for a submitted or previously seen file
oletools and oledump — Analysis of OLE and OOXML documents including macro extraction, embedded objects and template references
pdfid and pdf-parser — PDF structural analysis exposing object trees, JavaScript, embedded files and incremental update history
ANY.RUN / Tria.ge — Interactive detonation showing what a document actually does when opened, including network callouts
Aleph (OCCRP) — Search and cross-reference platform for large document corpora used in investigative journalism
The Sleuth Kit / Autopsy — Forensic examination of file system context, deleted content and timeline reconstruction around a file
CIRCL hashlookup — Rapid elimination of files that match known legitimate software distributions and vendor releases

A working method

A repeatable sequence beats ad-hoc searching. This is a practical starting workflow:

Preserve the original — Work on a verified copy, record acquisition detail and hash the original immediately so integrity can be demonstrated later.
Identify the true format — Determine format by magic bytes and structure rather than extension, since extension mismatch is itself a strong signal.
Extract metadata before opening — Pull all metadata blocks statically. Opening a document in its native application can alter it and can trigger active content.
Parse the structure — Enumerate embedded objects, macros, scripts, remote references and prior revisions, then extract anything recoverable from deleted regions.
Detonate if warranted — Run suspicious documents in an isolated sandbox to observe behaviour, network activity and dropped payloads.
Cross-reference the corpus — For document sets, aggregate metadata across all files to find shared authors, timezones, software and internal paths.
Pivot outward — Take hashes to malware repositories, author names to identity research, internal paths to infrastructure mapping, timestamps to timeline correlation.

How this connects across the intelligence taxonomy

Intelligence work does not respect neat boundaries. The mission domain you are working, the disciplines you practise, and the data points you pivot on are one connected system. These are the direct relationships for this entry — every link is also a tag, so you can follow any thread across the whole library.

Collected by these disciplines

Cyber Intelligence — Adversary Activity in Networks and Systems
Threat Actor Intelligence — Tracking Adversary Groups Over Time
Technical Intelligence — Technology Capability, Design, and Exploitation
Human Intelligence — Information from People, Ethically Obtained

Investigated in these domains

Pivots to these data points

File Hash — Cryptographic fingerprint of a file, used for malware identification.
CVE / Vulnerability — Common Vulnerabilities and Exposures identifier for a known flaw.
SSL/TLS Certificate — A digital certificate binding a public key to an identity.
Malware Family — A named class of related malicious software.
Onion / Hidden Service — A Tor hidden service address on the dark web.
Data Breach — A known data breach or leak incident with exposed records.

Inside the platform: where File / Document lives

The Quantus platform is 204 pages behind a 147-item sidebar organised into six working groups: Command (24 items), Dashboards (15), Threat Theaters (14), Intelligence Domains (15), Investigate (34), and Administration (45). This entry is not a page in isolation — it is a thread running through several of them.

The modules that matter most here:

datapoint.php?dp=dp_file — Data point hub
hash-profile.php — Malware dashboard
domain.php?d=insider — Insider Threat dashboard
domain.php?d=econspy — Economic Espionage dashboard
search.php — Advanced search, filter and pivot
correlate.php — Correlation graph
cases.php — Case management

Each dashboard is local-first: it renders from the platform’s own database rather than depending on a live third-party call, so it still works when an upstream API is unreachable or rate-limited. Heavy aggregates are cached with a hard query time cap and degrade to the last good value instead of hanging the page.

Automation, playbooks and AI skills

Analysis that only happens when someone remembers to run it is not a capability. The platform ships a 30-step automation pipeline (cron.php) that collects, ingests, resolves, enriches, correlates and scores on a schedule — 25 seeders, 11 resolvers and 7 enrichment runners, all idempotent and cursor-based so a run can be interrupted and resumed without duplicating or losing work.

AI skills that apply

The 16 one-click operations in ai-skills.php are deterministic jobs, not free-text generation. The ones that matter here:

Enrichment Runner
Enrichment → Local
Correlate Infrastructure
Summarise (Copilot)
Generate Report

Alerting closes the loop: rules in alerts.php fire on new indicators matching a saved query, so a first sighting in this area raises a notification rather than waiting to be noticed at the next review.

Feeds, data sources and the API

The collection layer runs a feed registry of free, machine-readable sources — bulk blocklists and trackers (Maltrail, IPsum, FireHOL, the full abuse.ch corpora, phishing databases, Emerging Threats, Spamhaus, DigitalSide, ThreatView), authoritative government feeds (CISA KEV, OFAC, UN and EU sanctions lists), and reference datasets (RIR allocations, ip-to-ASN and geolocation tables, MITRE ATT&CK, EPSS). collect.php pulls them server-side on a schedule; feeds.php and source-catalog.php show what is registered, what it covers and when it last ran.

Anything the platform holds is reachable programmatically. The REST API in api.php exposes 11 endpoints — status, stats, search, lookup, recent, export, bulk_check, top_threats, by_category, categories, check — and export.php streams 18 formats in bounded chunks, so a million-row export neither exhausts memory nor times out:

STIX 2.1, MISP, OpenIOC 1.1, CEF (ArcSight), LEEF 2.0 (QRadar), Zeek/Bro intel, Snort/Suricata rules, Palo Alto EDL, BIND RPZ, hosts blackhole, iptables, CSV, JSON, NDJSON/JSONL, XML.

That covers the CTI standards (STIX 2.1, MISP, OpenIOC), SIEM ingestion (CEF, LEEF, Zeek), detection engines (Snort/Suricata), and direct enforcement (Palo Alto EDL, BIND RPZ, hosts, iptables) — so intelligence developed here can be actioned in the tools you already run, without a manual reformatting step. A TAXII 2.1 server and a MISP/RSS feed are also served for pull-based sharing.

Use cases

Three ways this entry earns its keep in day-to-day work:

Triage under time pressure. An artifact or report lands and you need a defensible read in minutes, not days. Preserve the original is the first move; the platform pre-computes the enrichment so the analyst spends the time on judgement rather than lookups.
Building the picture. A single indicator is rarely the story. Extract metadata before opening turns one artifact into a network — shared infrastructure, repeated selectors, the same operator behind different names — via the correlation graph and the cross-entity link engine.
Producing something actionable. Analysis that ends in a document nobody can use is wasted. Pivot outward feeds the case file, the detection rule, the block list or the referral — with sourcing attached so the recipient can verify it.

Case management (cases.php), watchlists, saved searches and scheduled reports mean the work persists between sessions and survives an analyst leaving the team.

How each sector uses File / Document

The same entry is worked very differently depending on who you are, what authority you hold, and what you are ultimately producing. A military analyst is supporting a commander’s decision; a journalist is meeting a publication standard; an NGO caseworker is protecting a person. The underlying artifacts are shared — the constraints, outputs and thresholds are not.

🎖 Military and defence

Document and media exploitation is a recognised defence discipline. A captured or recovered file yields hashes for repository lookup, authorship and organisation metadata, template paths that expose internal network shares, embedded objects, and geotagged imagery that supports pattern of life and terrain assessment. Outputs feed intelligence preparation of the environment, force protection advisories and targeting support products, always through the collection and exploitation chain rather than by an analyst opening a file on a general purpose workstation. Constraints are handling: captured material has evidentiary and legal status under the applicable operational law framework, active content can compromise the exploitation environment, and personal data of protected persons must be handled under the mission's data policy.

🕵 National intelligence

Files are a primary collection product and a fusion problem. A single document set can carry authorship, organisational structure, software estate, internal naming conventions and timeline anchors, all of which corroborate or contradict reporting from other disciplines. Requirements-driven exploitation prioritises the fields that answer the standing question rather than exhaustively parsing everything. Classification follows both the content and the collection method, and derivative products must not reveal the acquisition. Corpus-level metadata analysis is particularly valuable for testing whether a purported leak is genuine, internally consistent and complete, which is a question that arises before any of the content can safely be used in an assessment.

👮 Law enforcement

For law enforcement the file is an exhibit before it is intelligence. Acquisition must be documented, the original preserved write-protected, hashes computed and reverified, and all analysis performed on verified copies under a recorded methodology. Metadata is frequently the decisive evidence in fraud, forgery and insider cases because it dates authorship and shows editing history that the content itself conceals. Access to files held by providers requires production orders or mutual legal assistance, and privileged material must be filtered through an agreed protocol before investigators see it. Present metadata findings with the tool, version and method used, because the reliability of extraction is a routine defence challenge.

🔍 Private investigation and corporate security

Corporate investigators live in document evidence: leaver exfiltration cases, expense fraud, forged contracts and disclosure exercises. Metadata answers who authored a document, when it was edited, on which machine and from which template, which repeatedly resolves cases where the content is disputed. The constraints are consent and confidentiality. Examine company-owned devices under a policy the employee was notified of, take advice before examining personal devices, and never upload client documents to public analysis services, which is disclosure to a third party and to everyone else with access. Preserve originals and hashes so the work survives an employment tribunal or civil challenge.

📰 Journalism and OSINT media

For journalists, files are both the story and the risk. Metadata verifies authenticity, dates a claim and often identifies who created a document, but it also identifies your source. Strip metadata before publishing any document, and understand that redaction by drawing a black box over text in a PDF frequently leaves the underlying text recoverable. Never upload source-derived material to a public multi-scanner or online metadata service. Where a leaked corpus is offered, corpus-level metadata analysis is the fastest way to test whether it is internally consistent and genuine. Give subjects a right of reply based on the documents' content, and consider whether publishing a document endangers people named in it.

🌍 NGO, humanitarian and human rights

Human rights documentation depends on files: photographs of damage, video of an incident, testimony recordings, leaked orders. Chain of custody and hashing at collection are what make that material usable by a court or a commission years later. Metadata including timestamps and location can corroborate a testimony, and it can equally endanger the person who filmed it, so strip and archive separately before any publication or sharing. Obtain informed consent for collection and for any onward use, store the originals encrypted with keys held outside the operating country, and train field staff on the difference between an original file and a re-encoded copy shared through a messaging app.

🎓 University and research

Research on document corpora spans digital forensics, provenance, disinformation and computational social science. Reproducibility requires publishing per-file hashes, the extraction tool and version, and the parsing decisions made, since different tools report different fields from the same file. Ethics review is required whenever a corpus contains personal data or was obtained through a leak, and many institutions have specific policies on unlawfully obtained material. Prefer publishing derived features and hashes over redistributing the corpus. Where geolocation or authorship metadata could identify individuals, aggregate or withhold, and document the withholding so the methodology remains assessable.

Playbook: working File / Document end to end

A repeatable sequence, from the moment the requirement lands to the moment a product is delivered and the case is closed out. Each phase states what you are trying to establish, not merely what to click — the point is a defensible chain of reasoning, not a checklist.

Phase 1 — Preserve and record acquisition

Work only on verified copies. Record how the file was obtained, from whom, when, by what tool and in what state, then hash the original immediately and store it write-protected. Every later step references that hash. A good output is an acquisition record another examiner could follow to reproduce your starting point. Stop and escalate before ingesting anything whose provenance you cannot describe, particularly leaked corpora, because the legality of possession may need advice before the technical work begins.

Phase 2 — Determine the true format

Identify the format from magic bytes and internal structure rather than from the extension, because extension mismatch is itself a strong signal and because many formats are containers pretending to be simple files. OOXML documents are ZIP archives, many image formats embed other formats, and polyglot files are valid as more than one type simultaneously. A good output is a recorded format identification with the evidence. Stop and treat the object as hostile if the structure contradicts the declared type.

Phase 3 — Extract metadata statically

Pull every metadata block before opening the file in its native application, because opening a document can alter timestamps, trigger remote content loading and execute active content. Capture EXIF, IPTC and XMP for images, document properties, revision identifiers, template paths and last-saved-by fields for office formats, and producer and creation tool strings for PDFs. A good output is a complete metadata dump stored alongside the hash, not a screenshot of a properties dialog.

Phase 4 — Parse the internal structure

Enumerate embedded objects, macros, scripts, external references, remote template links, attached files and prior incremental revisions. PDFs retain earlier versions of edited content in incremental updates, and OOXML parts carry relationships that reveal what a document once referenced. A good output is an inventory of every component with a note on which are active content. Stop and hand to malware analysis if active content is present rather than continuing in a general purpose environment.

Phase 5 — Recover redacted and deleted content

Test whether redactions were applied as true content removal or as a visual overlay, because a black rectangle drawn over text leaves the text extractable. Examine incremental updates, track changes, hidden rows and columns, cropped image regions retained in the file, and speaker notes. A good output states explicitly what was recovered and by what mechanism. This is the single highest-yield step on documents that an organisation believed it had sanitised before release.

Phase 6 — Assess authenticity and manipulation

Test whether the file is what it claims to be: internal consistency of timestamps, software version strings that postdate the claimed creation date, resaving artefacts, compression history in images, and any C2PA provenance manifest present. Contradiction between metadata layers is usually stronger evidence than any single field. A good output is an authenticity assessment with the specific inconsistencies listed. Note that absence of manipulation evidence is not evidence of authenticity.

Phase 7 — Detonate when warranted

Where the file is suspected malicious, execute it in an isolated sandbox and record the process tree, dropped files, persistence, registry changes and network callouts. Detonation answers what a document actually does when opened, which static analysis of an obfuscated macro often cannot. A good output is a behavioural report with extracted indicators. Never detonate customer or source material on a public sandbox where the sample and its content become available to other users.

Phase 8 — Aggregate metadata across the corpus

For document sets, the corpus is the analytic unit. Aggregate authors, organisations, template paths, software versions, time zones and creation dates to reveal the collection's provenance, its internal consistency and its boundaries. A cluster of files whose metadata does not fit the rest is either an insertion or a different collection stage. A good output is a summary table plus a list of anomalies. This is the fastest available test of whether a purported leak is genuine.

Phase 9 — Reconstruct the timeline

Build a single timeline from creation, modification and access timestamps, revision histories, embedded timestamps, and any file system or archive metadata, then compare against the timeline asserted by the case. Be explicit about which timestamps are reliable: application-recorded times are harder to alter than file system times, and time zone handling differs between formats. A good output is a timeline with a reliability rating on each entry rather than a flat chronology.

Phase 10 — Pivot outward

Take hashes to malware repositories, author and organisation names to identity and corporate research, internal paths and share names to infrastructure mapping, embedded URLs to web infrastructure analysis, and geotags to location assessment. This is where a single file becomes an investigation. A good output is a set of onward leads each tagged with the file and field that produced it, so the provenance of every downstream finding traces back to a specific artifact.

Phase 11 — Handle personal and privileged content

Identify personal data, special category data and potentially privileged material early and apply the appropriate controls: restricted access, a filter protocol for privileged content, and minimisation of what enters the analytic dataset. In leak corpora this is often the majority of the content. A good output is a processing decision recorded per category with the lawful basis. Stop and take advice where privileged material has been ingested, because remediation is procedural rather than technical.

Phase 12 — Report with provenance and preserve for disclosure

Present findings with the file hash, the field or structure they came from, the tool and version used, and the extraction date, so any conclusion can be independently reproduced. Retain the originals, the working copies and the tool logs for the retention period the case requires, and apply deletion when the authorised purpose ends. A good output is a report where every factual assertion about a document can be traced to a specific artifact and a specific extraction step.

The platform ships this as a step-checked workflow in playbooks.php, so progress is recorded against a case rather than held in someone’s head.

Source register: what to collect from, and how

Sources are listed with their access model so you can plan around cost and licensing before you build a dependency on them. Open means no account required; registration means a free account or API key; licensed means paid or institutional access. Always confirm current terms — licensing changes, and a source that was free for research may not be free for commercial or evidential use.

Source	Access	What it gives you	How it is used here
ExifTool	Open	Comprehensive metadata reader and writer covering image, video, document and archive formats with per-format field detail.	The default first-pass extraction tool for any file, producing a complete metadata record before the file is opened.
VirusTotal	Registration	Multi-engine reputation, structural parsing and behavioural reporting for submitted or previously seen files.	Checks whether a file hash is already known malicious, without submitting sensitive material.
oletools	Open	Python toolkit for analysing OLE and OOXML documents including macro extraction, embedded objects and remote template references.	Extracts and deobfuscates macros and identifies remote template injection in suspicious office documents.
pdfid and pdf-parser	Open	PDF structural analysis tools exposing object trees, JavaScript, embedded files, launch actions and incremental update history.	Recovers earlier revisions and identifies active content in PDFs without rendering the document.
Tria.ge	Registration	Automated sandbox producing process trees, network capture, dropped files and family identification for detonated documents.	Establishes what a suspicious document actually does when opened, in an isolated environment.
ANY.RUN	Registration	Interactive sandbox allowing an analyst to drive a document through multi-stage user interaction during detonation.	Handles documents that require clicking through prompts before the malicious behaviour executes.
Autopsy and The Sleuth Kit	Open	Open source digital forensics platform for file system analysis, carving, timeline generation and keyword search.	Recovers deleted files and builds file system timelines around a document of interest on seized media.
Aleph	Registration	OCCRP platform for indexing, searching and cross-referencing large document collections with entity extraction.	Makes a large leaked or obtained corpus searchable and links named entities across documents.
DocumentCloud	Registration	Journalism platform for uploading, OCR processing, annotating and publishing primary source documents.	Supports corpus review and controlled publication of source documents with annotations for readers.
C2PA Content Credentials	Open	Open specification for cryptographically signed provenance manifests recording capture and edit history of media.	Verifies claimed provenance for images and video where a signing capture device or editor was used.
NIST Computer Forensics Tool Testing	Open	Independent testing programme evaluating forensic tools against defined specifications with published results.	Supports a defensible statement that the extraction tool used has known and tested behaviour.
SWGDE best practice documents	Open	Practitioner guidance from the Scientific Working Group on Digital Evidence covering acquisition, examination and documentation.	Provides the methodological baseline that makes document examination defensible in court.
CIRCL hashlookup	Open	Free service identifying whether a file hash belongs to a known legitimate software distribution.	Eliminates benign system and application files from a large recovered corpus during triage.
YARA	Open	Pattern matching engine used to scan document corpora for structural and content indicators at scale.	Finds all files in a corpus sharing a specific embedded object, template path or exploit construct.

Prefer sources that publish a methodology and a revision history. A dataset that changes silently is a liability in any product that has to survive challenge.

Tooling

Tools commonly used against File / Document. None of these replace judgement, and each carries its own failure modes — know what a tool infers versus what it observes.

ExifTool — Reads and writes metadata across hundreds of formats with unmatched field coverage. Limitation: reports what is present, with no interpretation of whether a field was forged.
oletools suite — Extracts macros, embedded objects and remote template references from office documents. Limitation: heavily obfuscated macros still require manual deobfuscation.
pdf-parser and qpdf — Expose PDF object structure, incremental updates and streams for recovery of prior revisions. Limitation: malformed PDFs crafted to break parsers require manual handling.
binwalk — Identifies and extracts embedded file systems and appended data inside container files. Limitation: high false positive rate on compressed or encrypted content.
Autopsy — Full forensic examination platform with timeline, carving and keyword search across acquired media. Limitation: steep resource requirements on large corpora.
Aleph or DocumentCloud — Index, OCR and cross-reference large document collections with entity extraction. Limitation: OCR quality determines everything downstream and degrades on poor scans.
Isolated sandbox — Detonates documents to observe real behaviour including multi-stage payload retrieval. Limitation: public sandboxes disclose your sample to other users permanently.
Write blocker and imaging suite — Acquires media without altering the source and records verification hashes. Limitation: preserves integrity only from acquisition onward, not before.
Metadata stripping tools — Remove identifying metadata before publication or sharing of documents. Limitation: content-embedded identifiers such as printer tracking dots and visible artefacts survive.

AI skills and automation in detail

These are deterministic jobs with defined inputs and outputs, not open-ended prompting. Each is idempotent and cursor-based: interrupt one and it resumes where it stopped rather than duplicating work or losing progress.

Enrichment Runner — Walks the indicator set through a chosen provider in time-boxed, cursor-based batches that resume rather than restart.
Enrichment → Local — Materialises enrichment into the local store so dashboards render from your own database instead of a live third-party call.
Correlate Infrastructure — Builds the cross-entity link graph: shared hosting, reused certificates, overlapping registrants, repeated selectors.
Summarise (Copilot) — Produces a narrative summary beside the underlying records. It explains; it never creates indicators or assigns attribution.
Generate Report — Assembles a sourced product from the current case or query, with provenance attached to each element.

A note on the boundary: the only skill that involves a language model is Summarise (Copilot), and it writes prose about records that already exist. Nothing else on this list involves generation of any kind. No indicator, relationship or attribution in the platform originates from a model. See the full skill list.

Tradecraft notes

The distinctions that separate a competent analyst from a fast one:

Extract before you open. Opening a document in its native application updates timestamps, may load remote content that notifies the author that the file was read, and can execute active content, so the first look must always be static and on a copy.
A black rectangle over text is not redaction. Improper PDF redaction, hidden spreadsheet rows, cropped image regions retained in the file and track changes left enabled have produced more accidental disclosures than any technical exploit, and they are the first things to check.
The corpus is the analytic unit for leaks. Aggregate metadata across every file to find the shared authors, time zones, template paths and software versions, because the fastest test of whether a purported leak is genuine is whether its internal consistency matches its claimed origin.
Distinguish application-recorded timestamps from file system timestamps and say which you used. File system times change on copy and are trivially altered; application revision metadata is harder to forge and survives transfer, which makes it far better timeline evidence.
Re-encoding destroys evidence silently. A photograph shared through a messaging platform loses its EXIF and is recompressed, so the analytic value depends entirely on obtaining the original from the device rather than the copy that reached you.
Template paths and last-saved-by fields expose internal infrastructure. A UNC path to an internal share, a corporate template location or a username convention in a leaked document is often the most actionable single field in the entire metadata block.
Absence of manipulation evidence is not proof of authenticity. Forgery that starts from a genuine file and edits content within the same application leaves very little trace, so authenticity claims should rest on corroboration from independent sources rather than on a clean metadata report.
Never submit client, source or victim-derived documents to a public analysis service. Submission is irreversible disclosure, and targeted phishing documents in particular carry victim-specific content that identifies exactly who was being attacked.

Measuring whether it is working

Capability claims should be falsifiable. These are the measures that show whether work on File / Document is producing anything, and they are worth baselining before you change process or tooling.

Proportion of examined files with a complete acquisition record and verified hash at every handling step. Anything less is an argument available to opposing counsel.
Rate of accidental disclosure incidents caused by improper redaction or unstripped metadata in the organisation's own published documents, which should trend to zero after a sanitisation process is introduced.
Percentage of document analyses where findings cite the specific field, tool and version, allowing independent reproduction rather than asking the reader to trust the analyst.
Number of onward investigative leads generated per exploited document set, which measures whether exploitation is producing intelligence rather than describing files.
Time from receipt of a suspicious attachment to a behavioural verdict, measured for the incident response queue, since slow triage pushes users toward opening the file themselves.
Count of customer, source or victim-derived files submitted to public analysis services. The target is zero and any occurrence should trigger a review.
Corpus authenticity assessments completed before content was used in a product, expressed as a proportion of leak-derived investigations.

Beware of measuring volume alone. Indicator counts and report counts rise easily and say little; time-to-attribution, proportion of findings that survive review, and how often a product changed a decision say a great deal.

Common pitfalls

Metadata is trivially editable and is deliberately falsified in influence operations, so treat it as a claim requiring corroboration.
Timestamps depend on the creating machine's clock and timezone settings, which may be wrong, deliberately altered or simply unset.
Copying, syncing or opening a file frequently rewrites metadata and destroys the very evidence you were trying to preserve.
Redaction applied visually rather than structurally leaves the underlying text fully recoverable, and the reverse assumption also causes false confidence.
Converting between formats silently discards metadata layers, so an analysed copy may be missing what the original contained.
Publicly submitting a leaked or client document to an online scanning service discloses its contents irreversibly.

Legal and ethical considerations

Files are the highest-risk artifact class for handling errors because they combine personal data, privileged material and sometimes unlawfully obtained content in one object. Establish lawful basis before ingesting leaked corpora and take advice where possession itself may be restricted. Maintain hashes and an unbroken chain of custody for anything that may become evidence. Restrict access to material containing personal data, avoid public submission of client or leak-derived files, and apply retention rules that require deletion once the authorised purpose ends.

Data integrity: no fabrication, no drift, no hallucination

Intelligence that cannot be traced back to a source is not intelligence, it is assertion. Everything in this entry — and everything in the platform behind it — is built on a small number of non-negotiable rules.

Provenance on every record

Every indicator carries the source that supplied it, a first-seen and last-seen timestamp, and a sighting count. Where several feeds report the same artifact, each contribution is recorded separately rather than collapsed, so you can see whether a finding rests on one source or twelve. Source attribution travels with the data into every export, so a recipient can audit a claim without asking you for the working.

Nothing is invented to fill a gap

If the platform has no data for File / Document, it says so. Empty is displayed as empty — never padded with plausible-looking placeholder values, sample records or illustrative examples that a reader might mistake for observations. A dashboard with no rows is a true statement about collection coverage, and it is treated as a gap to close, not a blemish to hide.

Scoring is deterministic and reproducible

Threat scores, reputation grades and risk tiers are computed from stated inputs with fixed weights, not estimated. The same inputs always produce the same output, and the formula is visible rather than a black box. Aggregates are cached with an explicit time-to-live so a figure on screen is never silently stale — and when a heavy query exceeds its time budget the platform serves the last known-good value and labels it, rather than inventing a fresh number or hanging.

Where AI is used, and where it is not

Language models summarise and explain. They do not create indicators, assign attribution or manufacture relationships. No IP address, wallet, hash or identity in the platform originates from a model — every one is ingested from a named feed, resolved from a reference dataset, or entered by an analyst with a source recorded. Copilot output is presented as narrative alongside the underlying records, never in place of them, so a reader can always check the summary against the evidence.

Guarding against drift

Enrichment is additive and timestamped rather than overwriting. Reference data — sanctions lists, allocations, taxonomies — is re-synchronised from the authority on a schedule instead of being edited in place, so local copies cannot quietly diverge from the source of truth. Attribution is recorded with a confidence level and the reporting it rests on, and inferred relationships are labelled as inferred. When a source retracts or corrects, the correction propagates rather than leaving a stale assertion behind.

What this means for you

You can put a finding from this platform in front of a regulator, a court, a board or a partner agency and show where each element came from. That is the standard the tooling is built to — because in this work, being confidently wrong is more damaging than being usefully uncertain.

By the numbers

The taxonomy this entry belongs to is not a marketing list — it is the actual structure of the platform: 52 mission domains, 52 intelligence disciplines and 65 data points, each with a live dashboard behind it. Supporting that: 18 indicator types, 14 playbooks, 16 AI skills, 18 export formats and a 30-step automated pipeline.

This particular entry connects directly to 4 intelligence disciplines, 3 mission domains, 6 closely related entries — every one of them a tag you can follow, and a dashboard you can open.

Questions analysts actually ask

Can I trust the timestamps in a document?

Partly, and the distinction between timestamp types is what matters. File system timestamps change when a file is copied, emailed or restored from backup and are trivially altered with common tools, so they are weak evidence on their own. Application-level metadata such as OOXML revision identifiers, total editing time, print history and PDF incremental update structure is harder to forge convincingly and survives transfer. The strongest position is corroboration: application metadata that agrees with file system data, server logs, email headers and content references produces a defensible timeline. State the reliability of each entry rather than presenting a flat chronology.

How do I check whether a PDF redaction is real?

Extract the text layer and the embedded objects rather than looking at the rendered page. If the redacted words appear in the extracted text, the redaction is a drawn overlay and the content was never removed. Also examine incremental updates, because PDFs append changes rather than rewriting, so an earlier unredacted version of the page frequently survives in the file. Check attached files, form field values and image objects that may have been cropped visually rather than trimmed. Proper redaction removes the underlying content and flattens the document, and it should be verified by re-extraction after processing.

Is it safe to open a suspicious document to look at it?

Not on a normal workstation. Documents remain a primary delivery vector through macros, remote template injection, embedded objects and rendering vulnerabilities, and simply opening one can retrieve remote content that tells the sender you engaged. Extract metadata and structure statically first, using tools that parse rather than render. If you need to see the content, use an isolated environment with no route to production and controlled egress, or a sandbox. For client or source material, use a private analysis environment rather than a public one, because public submission discloses the document permanently.

What can metadata tell me about a leaked corpus?

Frequently more than the content does at the triage stage. Aggregate authorship, organisation strings, template paths, software versions, time zones and creation date distributions across all files. A genuine first-party export shows a coherent internal picture: consistent template paths, an organisationally plausible spread of authors and software, and dates that stop at the claimed exfiltration point. Aggregations and fabrications show discontinuities, files whose metadata does not fit, resaving artefacts across the whole set, or date ranges inconsistent with the story. Report the anomalies specifically rather than concluding genuine or fake.

Should I strip metadata before publishing a document?

Yes, always, and verify by re-extraction after stripping. Metadata routinely identifies the author, their organisation, the machine, the internal file path and, for images, the device and location. For a leaked document, any of those can identify your source. Publish a sanitised version and retain the original under access control so you can still substantiate the document's provenance if challenged. Be aware that stripping does not remove content-embedded identifiers such as visible watermarks, subtle textual variations planted to trace recipients, or printer tracking patterns in scanned pages.

How do I handle a corpus that contains privileged or special category data?

Identify it early and apply a filter protocol before investigators or analysts see it. For privileged material, the standard approach is an independent review team that segregates privileged documents before the case team receives the corpus, with the process agreed in advance and documented. For special category personal data, minimise what enters the analytic dataset, restrict and log access, and record the lawful basis per category. If privileged material has already reached the case team, stop and take advice, because the remedy is procedural and the failure to act promptly is what causes the real damage.

What does a C2PA manifest actually prove?

That a specific signer asserted a specific capture and edit history, and that the asserted history has not been altered since signing. It does not prove that the image depicts what it appears to depict, and its absence proves nothing at all, since the overwhelming majority of media carries no manifest. Where a manifest is present, verify the signature chain and read what the manifest actually claims, which may be limited to a single editing step. Treat it as one corroborating signal alongside content analysis, source testimony and independent geolocation rather than as an authenticity verdict.

Standards, frameworks and further reading

Work that references a recognised framework is easier to defend, easier to hand over, and easier for a partner to consume:

ISO/IEC 27037 governs identification, collection, acquisition and preservation of digital evidence, including hashing and documentation requirements.
ISO/IEC 27041 and 27042 address assurance of investigation methods and the analysis and interpretation of digital evidence.
SWGDE best practices define practitioner-level expectations for imaging, examination, documentation and reporting of digital evidence.
NIST Computer Forensics Tool Testing provides independently tested tool behaviour, supporting statements about extraction reliability.
C2PA specification defines cryptographically signed content provenance manifests for images, video and documents.
ECMA-376 and ISO/IEC 29500 define the OOXML document format whose parts, relationships and revision identifiers are the basis of office metadata analysis.
ISO 32000 defines PDF, including the incremental update mechanism that preserves earlier document revisions.
GDPR Articles 5, 6 and 9 govern the personal and special category data that document corpora inevitably contain.

References

Primary sources and authoritative references for this entry. Publishers revise and retire material, so treat the retrieval date as part of the citation and re-check before relying on any of it in a formal product.

ExifTool — Phil Harvey. Reference metadata extraction tool covering the widest range of file formats.
Best Practices for Digital Evidence — Scientific Working Group on Digital Evidence. Practitioner guidance on acquisition, examination and documentation of digital exhibits.
Computer Forensics Tool Testing Program — National Institute of Standards and Technology. Independent evaluation of forensic tools against published specifications.
Content Credentials specification — Coalition for Content Provenance and Authenticity. Open standard for signed media provenance manifests.
The Sleuth Kit and Autopsy — Basis Technology and open source community. Open source forensic platform for file system analysis, carving and timeline construction.
Aleph — OCCRP. Investigative platform for indexing and cross-referencing large document collections.
DocumentCloud — MuckRock. Platform for OCR, annotation and publication of primary source documents in journalism.
hashlookup — CIRCL. Known-software hash service used to eliminate benign files from recovered corpora.

Link integrity: every reference above was verified with a live request when this page was generated. Where a publisher had moved or withdrawn a document, the link was repointed at a preserved copy in the Internet Archive and marked as archived. Anything with no reachable copy anywhere had its link removed rather than left to rot — the source is still credited, it simply cannot be linked.

Put it into practice

The Quantus Intel threat intelligence platform operationalises this entry: structured metadata extraction, corpus-wide cross-referencing and automatic pivots from file artifacts to identities and infrastructure. Explore the platform, or browse the rest of the library by following any tag above.