pdf_file = PdfFileReader(args.PDF_FILE)
xmpm = pdf_file.getXmpMetadata()

if xmpm is None:
print("No XMP metadata found in document.")
sys.exit()

We can use custom_print() ) method to extract and print relevant values, such as title, creator, contributors, etc., as shown below.

custom_print("Title: {}", xmpm.dc_title)
custom_print("Creator(s): {}", xmpm.dc_creator)
custom_print("Contributors: {}", xmpm.dc_contributor)
custom_print("Subject: {}", xmpm.dc_subject)
custom_print("Description: {}", xmpm.dc_description)
custom_print("Created: {}", xmpm.xmp_createDate)
custom_print("Modified: {}", xmpm.xmp_modifyDate)
custom_print("Event Dates: {}", xmpm.dc_date)

If you use multiple software to create PDFs, you can also define The custom_print( ) method is shown below.

def custom_print(fmt_str, value):
   if isinstance(value, list):
      print(fmt_str.format(", ".join(value)))
   elif isinstance(value, dict):
      fmt_value = [":".join((k, v)) for k, v in value.items()]
      print(fmt_str.format(", ".join(value)))
   elif isinstance(value, str) or isinstance(value, bool):
      print(fmt_str.format(value))
   elif isinstance(value, bytes):
      print(fmt_str.format(value.decode()))
   elif isinstance(value, datetime.datetime):
      print(fmt_str.format(value.isoformat()))
   elif value is None: print(fmt_str.format("N/A"))
else:
print("warn: unhandled type {} found".format(type(value)))

We can also extract any other custom properties stored by the software as shown below.

if xmpm.custom_properties:
print("Custom Properties:")

for k, v in xmpm.custom_properties.items():
print("t{}: {}".format(k, v))

The above script will read a PDF document and print the metadata stored in the XMP format, including some custom properties stored by the software with which the PDF was created.

Windows Executable Files

Sometimes you may encounter a suspicious or unauthorized executable file. However, for investigative purposes, it may be useful because it has embedded metadata. We can obtain its location, purpose, and other properties, such as manufacturer and compilation date. With the help of the following Python script, we can obtain the compilation date and useful data from header files and imported and exported symbols.

To do this, first install the third-party Python library pefile. This can be done by following these steps.

pip install pefile

Once you have successfully installed it, import the following library as shown below.

from __future__ import print_function

import argparse
from datetime import datetime
from pefile import PE

The command line handler will now accept a positional argument, essentially representing the file path to the executable. You can also choose the output style: whether you prefer a detailed, coarse, or simplified output. To do this, you need to provide an optional argument, as shown below.

parser = argparse.ArgumentParser(‘Metadata from executable file’)
parser.add_argument(“EXE_FILE”, help = “Path to exe file”)
parser.add_argument(“-v”, “–verbose”, help = “Increase verbosity of output”,
action = ‘store_true’, default = False)
args = parser.parse_args()

</pre>
<p>Now, we will load the input executable file using the PE class. We will also dump the executable data into a dictionary object using the <strong>dump_dict()</strong> method. </p>
<pre><code class="language-python line-numbers">pe = PE(args.EXE_FILE)
ped = pe.dump_dict()


We can extract basic file metadata such as embedded authorship, version and compilation time using the code shown below −

file_info = {}
for structure in pe.FileInfo:
   if structure.Key == b'StringFileInfo':
      for s_table in structure.StringTable:
         for key, value in s_table.entries.items():
            if value is None or len(value) == 0:
               value = "Unknown"
            file_info[key] = value
print("File Information: ")
print("==================")

for k, v in file_info.items():
   if isinstance(k, bytes):
k = k.decode()
if isinstance(v, bytes):
v = v.decode()
print("{}: {}".format(k, v))
comp_time = ped['FILE_HEADER']['TimeDateStamp']['Value']
comp_time = comp_time.split("[")[-1].strip("]")
time_stamp, timezone = comp_time.rsplit(" ", 1)
comp_time = datetime.strptime(time_stamp, "%a %b %d %H:%M:%S %Y")
print("Compiled on {} {}".format(comp_time, timezone.strip()))

We can extract useful data from the header file as follows

for section in ped['PE Sections']:
print("Section '{}' at {}: {}/{} {}".format(
section['Name']['Value'], hex(section['VirtualAddress']['Value']),
section['Misc_VirtualSize']['Value'],
section['SizeOfRawData']['Value'], section['MD5'])
)

Now, extract the list of imports and exports from the executable, as shown below.

if hasattr(pe, 'DIRECTORY_ENTRY_IMPORT'):
print("nImports: ")
print("=========")

for dir_entry in pe.DIRECTORY_ENTRY_IMPORT:
dll = dir_entry.dll

if not args.verbose:
print(dll.decode(), end=", ")
continue
name_list = []

for impts in dir_entry.imports:
if getattr(impts, "name", b"Unknown") is None:
name = b"Unknown"
else:
name = getattr(impts, "name", b"Unknown")
name_list.append([name.decode(), hex(impts.address)])
name_fmt = ["{} ({})".format(x[0], x[1]) for x in name_list]
print('- {}: {}'.format(dll.decode(), ", ".join(name_fmt)))
if not args.verbose:
print()

Now, use the following code to print exports, name, and address.

if hasattr(pe, 'DIRECTORY_ENTRY_EXPORT'):
print("nExports: ")
print("=========")

for sym in pe.DIRECTORY_ENTRY_EXPORT.symbols:
print('- {}: {}'.format(sym.name.decode(), hex(sym.address)))

The above script will extract basic metadata and information from the header files of Windows executable files.

Office File Metadata

Most computing work is done in the three MS Office applications—Word, PowerPoint, and Excel. These files possess extensive metadata that can reveal interesting information about their authors and history.

Note that the metadata for the 2007 Word (.docx), Excel (.xlsx), and PowerPoint (.pptx) formats is stored in an XML file. We can process these XML files in Python with the help of the following Python script, as shown below.

First, import the required libraries, as shown below.

from __future__ import print_function
from argparse import ArgumentParser
from datetime import datetime as dt
from xml.etree import ElementTree as etree

import zipfile
parser = argparse.ArgumentParser('Office Document Metadata')
parser.add_argument("Office_File", help="Path to office file to read")
args = parser.parse_args()

Now, check if the file is a ZIP file. Otherwise, raise an error. Now, open the file and extract the key elements for processing using the following code −

zipfile.is_zipfile(args.Office_File)
zfile = zipfile.ZipFile(args.Office_File)
core_xml = etree.fromstring(zfile.read('docProps/core.xml'))
app_xml = etree.fromstring(zfile.read('docProps/app.xml'))

Now, create a dictionary to start extracting metadata.

core_mapping = {
   'title': 'Title',
   'subject': 'Subject',
   'creator': 'Author(s)',
   'keywords': 'Keywords',
   'description': 'Description',
   'lastModifiedBy': 'Last Modified By',
   'modified': 'Modified Date',
   'created': 'Created Date',
   'category': 'Category',
   'contentStatus': 'Status',
   'revision': 'Revision'
}

Use the iterchildren() method to access each tag in the XML file:

for element in core_xml.getchildren():
for key, title in core_mapping.items():
if key in element.tag:
if 'date' in title.lower():
text = dt.strptime(element.text, "%Y-%m-%dT%H:%M:%SZ")
else:
text = element.text
print("{}: {}".format(title, text))

Similarly, do the same for the app.xml file that contains statistics about the file contents:

app_mapping = {
'TotalTime': 'Edit Time (minutes)',
'Pages': 'Page Count',
'Words': 'Word Count',
'Characters': 'Character Count',
'Lines': 'Line Count',
'Paragraphs': 'Paragraph Count',
'Company': 'Company',
'HyperlinkBase': 'Hyperlink Base',
'Slides': 'Slide Count',
'Notes': 'Note Count',
'HiddenSlides': 'Hidden Slide Count',
}
for element in app_xml.getchildren():
for key, title in app_mapping.items():
if key in element.tag:
if 'date' in title.lower():
text = dt.strptime(element.text, "%Y-%m-%dT%H:%M:%SZ")
else:
text = element.text
print("{}: {}".format(title, text))

Now, after running the above script, we can get different details about a particular document. Note that we can only apply this script to documents in Office 2007 or later.