HN Reader

New information extracted from Snowden PDFs through metadata version analysis

324

123

These PDFs apparently used the “incremental update” feature of PDF, where edits to the document are merely appended to the original file.

It’s easy to extract the earlier versions, for example with a plain text editor. Just search for lines starting with “%%EOF”, and truncate the file after that line. Voila, the resulting file is the respective earlier PDF version.

(One exception is the first %%EOF in a so-called linearized PDF, which marks a pseudo-revision that is only there for technical reasons and isn’t a valid PDF file by itself.)

27 days agoby layer8

The "print and scan physical papers back to a PDF of images" technique for final release is looking better and better from an information protection perspective.

27 days agoby password4321

There needs to be better tooling for inspecting PDF documents. Right now, my needs are met by using `qpdf` to export QDF [1], but it is just begging for a GUI to wrap around it...

[1] https://qpdf.readthedocs.io/en/stable/qdf.html

27 days agoby alhirzel

This is insightful work, great job.

Recently someone else revisited the Snowden documents and also found more info, but I can't recall the exact details.

Snowden and the archives were absolute gifts to us all. It's a shame he didn't release everything in full though.

27 days agoby Ms-J

> We contacted Ryan Gallagher, the journalist who led both investigations, to ask about the editorial decision to remove these sections. After more than a week, we have not received a response.

Hopefully we'll hear something now that the Christmas holidays are over.

27 days agoby c-c-c-c-c

Can someone spell out how this is possible? Do pdfs store a complete document version history? Do they store diffs in the metadata? Does this happen each time the document is edited?

27 days agoby pfisherman

In addition to the print paper and scan approach, I do wonder how effective it would be to “Print to XPS” and then “print” that into a PDF.

27 days agoby pseudosavant

Its crazy this is just being discovered now.

27 days agoby bawolff

% pdfresurrect -w epsteinfiles.pdf

27 days agoby treetalker

So this is almost certainly redaction by the journalists?

It is disappointing they didn't mark those sections "redacted", with an explanation of why.

It is also disappointing they didn't have enough technical knowhow to at least take a screenshot and publish that rather than the original PDF which presumably still contains all kinds of info in the metadata.

27 days agoby londons_explore

I have read claims that there were fake documents inserted in those leaks, who aimed at pushing disinformation.

27 days agoby jokoon