01Location
- trailer /Info → document information dictionary
- Catalog /Metadata → stream (/Type /Metadata /Subtype /XML) holding an XMP packet
- Earlier XMP packets left by incremental updates later in the file
02Questions it answers
- Which application created the original document and which produced the PDF?
- When was the PDF created and last modified, and when was its metadata last changed?
- Is this file a new incarnation of an earlier document (shared DocumentID, different InstanceID)?
- Do the Info and XMP values agree?
03Format and versions
| Format | Info entries are PDF text strings; dates use 'D:YYYYMMDDHHmmSS' with an optional offset such as +HH'mm (ISO 32000-1 §7.9.4). XMP is RDF/XML encoded in UTF-8 inside the metadata stream (PDF 1.4+). |
|---|---|
| Applies to | Info dictionary in all PDF versions; XMP metadata streams from PDF 1.4. Mapping per Adobe XMP Specification Part 3. |
04Key fields
| Field | What it tells you |
|---|---|
| Info: Title, Author, Subject, Keywords | Map to dc:title, dc:creator, dc:description and pdf:Keywords in XMP. |
| Info: Creator ↔ xmp:CreatorTool | Application that created the original content. |
| Info: Producer ↔ pdf:Producer | Software that produced the PDF. |
| Info: Trapped ↔ pdf:Trapped | Trapping status flag. |
| xmpMM:DocumentID | Common identifier for all versions and renditions of a resource. |
| xmpMM:InstanceID | Identifier of a specific incarnation, updated each time the file is saved. |
| xmpMM:OriginalDocumentID, xmpMM:DerivedFrom, xmpMM:History | Links to the source resource and a list of high-level actions that produced this one. |
05Timestamps
| Field | Encoding | Note |
|---|---|---|
| Info CreationDate, ModDate | PDF date string 'D:YYYYMMDDHHmmSS±HH'mm' | Only the year is mandatory; Chromium's parser assumes UTC when no offset is given. |
| xmp:CreateDate, xmp:ModifyDate | ISO 8601 subset (YYYY-MM-DDThh:mm:ss.sTZD) | A missing time zone designator means the zone is unknown and should not be assumed. |
| xmp:MetadataDate | ISO 8601 subset | When metadata was last changed; should be the same as or later than xmp:ModifyDate. |
Decode raw values with the Timestamp decoder and convert local wall-clock times with the Local time to UTC.
06Examination workflow
- Hash the file and locate every XMP packet and every Info dictionary, including those from incremental updates.
- Decode Info dates with their offsets and XMP dates with their designators; note values that lack a zone.
- Compare Info and XMP pairs (CreationDate/xmp:CreateDate, ModDate/xmp:ModifyDate, Creator/xmp:CreatorTool, Producer/pdf:Producer).
- Use DocumentID and InstanceID to relate the file to other copies or versions.
07Interpretation pitfalls
- Info and XMP can fall out of sync when software unaware of XMP edits Info; Acrobat resolves this by comparing ModDate with xmp:MetadataDate.
- Incremental saves append new packets without removing old ones; a naive search can read an outdated packet.
- xmp:ModifyDate is typically set before the file is saved and need not match the file system modification time.
- All of these values are writable by any PDF tool and do not authenticate the document.
09Sources
- XMP Specification Part 1 — Data model, serialization and core properties Adobe (XMP-Toolkit-SDK, GitHub) · checked 2026-10-14
- XMP Specification Part 2 — Additional properties Adobe (XMP-Toolkit-SDK, GitHub) · checked 2026-10-14
- XMP Specification Part 3 — Storage in files Adobe (XMP-Toolkit-SDK, GitHub) · checked 2026-10-14
- pdf.js — src/core/document.js (documentInfo) Mozilla (GitHub) · checked 2026-10-14
- pdf.js — src/core/catalog.js (Metadata) Mozilla (GitHub) · checked 2026-10-14
- Chromium source — pdf/pdf_utils/dates.cc (ISO 32000-1 §7.9.4 date parsing) The Chromium Authors (GitHub mirror) · checked 2026-10-14
- ISO 32000-1:2008 — Document management — Portable document format (Adobe-hosted copy) Adobe / ISO