Sanitizing Documents Before Sharing

Summary

A document can reveal information through its visible contents and through metadata. The mat2 documentation gives examples such as camera details and capture times in images, and author or company information in office files. LibreOffice's security options also identify comments, recorded changes and stored versions as information to check before sharing.

Use a release copy. Keep the original separately if it is needed for evidence, editing or verification. Decide which information must remain and which must be removed before starting.

1. Decide what you need to remove

If the document came from an untrusted source, start with Dangerzone. Do not open the original in an office suite just to inspect its properties. Its security model explains why it isolates document parsing and rebuilds a PDF from pixels.

2. Remove metadata from the release copy

mat2 supports metadata cleanup for a range of document, image, audio and archive formats. Its maintained repository documents the supported formats and command-line options. By default, it writes a separate file with .cleaned added to the filename:

mat2 --show release.pdf
mat2 release.pdf
mat2 --show release.cleaned.pdf

Run this on the working copy you intend to publish. Keep the source and output distinguishable. Avoid --inplace when you need to preserve the original. Avoid --lightweight when your aim is the most thorough cleanup: it deliberately trades some metadata removal for preserving file data.

The project warns that an empty --show result is not proof that no metadata exists. Complex formats cannot be exhaustively checked that way. Cleanup can also change rendering or remove selectable text, so inspect the result.

ExifTool reads and edits metadata across many formats, including EXIF information in images. Use its format support and documentation to decide what it can change in your file. Do not assume that a command which removes tags from a JPEG safely sanitizes every other format.

PDF trap: ExifTool uses incremental updates for PDF metadata edits. Its PDF documentation explicitly warns that the old information remains recoverable. Clearing the displayed PDF author with ExifTool alone is not secure removal of that information. Use a rebuilding workflow such as Dangerzone for the copy you intend to release, then inspect the output.

3. Redact the contents, not just their appearance

Drawing a black rectangle over text is not evidence that the text underneath was deleted. Use a redaction function that removes the underlying content when you finalize the document.

For a documented local workflow, LibreOffice redaction sends the document to Draw, where you mark regions for removal. Finish with Redacted Export (Black) or Redacted Export (White). The documentation distinguishes those final exports, which replace redacted content with pixels, from a PDF exported for intermediate review. Share the finalized export, not the editable drawing or the review copy.

Review comments, tracked changes and version information in editable documents too. Removing an author's name is not the same as removing a confidential passage from revision history. If recipients do not need editable history, prepare a final rendered copy and check what it displays.

4. Check the actual outgoing file

Reopen the final export. Inspect every page for missed text, faces, watermarks, headers and footers. Try searching for removed words and copying text from redacted regions into a plain-text editor. These are useful checks, not a proof against every form of disclosure. Check the metadata again after your last edit or export.

Choose a neutral filename: mat2's .cleaned suffix preserves the original basename. A filename containing a person's name or internal case identifier needs separate attention. Share only the final reviewed file, not the original, an editor backup or an archive containing both.

Printed and scanned pages need another check. EFF's research on printer tracking dots documents identifying marks in color laser output that can appear in scans. Removing file metadata does not remove identifying content in the page image. Do not assume printing and scanning makes a document anonymous, or that a metadata cleaner removes printer marks.

Trust model and limits

The tools run on your computer and parse files; keep them and the operating system updated. Prefer local processing for confidential material. Dangerzone's sandbox reduces document-exploit risk, but it cannot protect a host that is already compromised, and it deliberately preserves visible page content.

Sanitization does not hide which account sent a file or who had access to the original. For that wider plan, use Threat Modeling and Metadata Resistance. Protect retained originals with file and backup encryption.

Readiness

Usable, with manual review. The tools have documented workflows, but no single button establishes that a document is safe, anonymous and correctly redacted. A second trusted reviewer is useful when publication could expose someone.

Primary sources

• mat2: metadata examples, supported formats, commands and limitations.
• ExifTool documentation and reversible PDF metadata edits.
• Dangerzone security model.
• LibreOffice redaction and final export.
• LibreOffice warnings about personal data, comments and tracked changes.
• EFF's printer tracking research and its limits.