A school SOC examines publicly posted PDF handbooks during authorized OSINT. Which metadata insight is most relevant?
Select an answer to reveal the explanation.
Short Explanation
Those dusty Author fields in public PDFs sometimes shout the same username pattern as AD. That's free OSINT—not magic, and not illegal just because it's a school PDF on the web.
Full Explanation
Publicly posted PDF handbooks in school and municipal environments often retain document metadata such as author fields. Those usernames may match Active Directory or email naming conventions and therefore inform exposure analysis during authorized OSINT: they reveal account patterns useful to adversaries and to defenders tightening publication pipelines. Metadata review is a standard OSINT technique when collection of public files is authorized.
Claiming PDF metadata is always encrypted and never useful fails by concept: many public PDFs expose clear metadata. Asserting author fields can only reveal printer serial numbers, never usernames, is factually too narrow—author, creator, and producer fields commonly contain user or workstation identifiers. Declaring metadata OSINT illegal whenever a PDF is posted on a school website confuses public document analysis with unlawful interception.
Exam caveat: Correlate carefully—similar names are hypotheses until confirmed against other public or in-scope sources, and reports should avoid overclaiming that a metadata string equals a privileged AD account. Scrubbing metadata on future publications is a defensive recommendation; testers should not mass-delete public educational records. Some modern export pipelines already strip metadata—absence of fields is a positive hygiene signal.
Operational check: Download a sample public handbook PDF authorized for OSINT, inspect metadata with a viewer, note any username patterns, file an informational exposure finding with remediation guidance to strip metadata at publish time, and verify a republished sample no longer discloses author account strings.