What metadata hides in Office documents

The Office Open XML container (standardised as ECMA-376 and ISO/IEC 29500) keeps the document body in word/document.xml, xl/workbook.xml or ppt/presentation.xml, and the metadata in docProps/. Three files can live there: core.xml with the Dublin Core properties every package format shares, app.xml with application-specific statistics, and custom.xml with properties added by people or by systems such as SharePoint.

None of these parts is required for the document to open. Word, Excel and PowerPoint write them on every save, but a file without docProps is perfectly valid — which is exactly what makes cleaning safe. The values are plain XML text: no encryption, no obfuscation, readable by anyone with a text editor.

core.xml holds dc:creator (the name entered in Office's account or personalisation settings when the file was first saved) and cp:lastModifiedBy, which is filled in on every save with the current user's name. On shared or corporate machines that is often a login such as ACC-PC-03\accounting or a full email address. dcterms:created and dcterms:modified are UTC timestamps; cp:lastPrinted records the last time the document was sent to a printer.

cp:revision is a counter that Word increments each time the file is saved. A contract with revision 84 has been saved 84 times; a “final” proposal with revision 2 was probably copied from somewhere else. Title, subject, keywords, category and content status are also stored here and travel into PDF exports as the PDF's own Title and Author fields.

app.xml starts with Application and AppVersion — for example “Microsoft Office Word” and “16.0000” — and continues with Company and Manager, which Office fills from the organisation name entered during installation or from the account. Template names the .dotm the document was based on; Normal.dotm is harmless, but a template called Smith-Jones-LLP-Pleading.dotm tells a reader which firm drafted the file.

TotalTime is the number of minutes the document has been open in the foreground across all sessions — a figure of 872 means more than fourteen hours of work, which clients, opposing counsel or an editor may find interesting. Pages, Words, Characters and Lines are just statistics, while HyperlinkBase can contain a local folder path with a user name in it.

Every comment in word/comments.xml carries w:author, w:initials and w:date. Every tracked insertion, deletion or formatting change in document.xml carries the same attributes, and they survive even if the reviewer's name is later changed in Options. Since Word 2013, word/people.xml lists each reviewer together with a provider ID (“AD” for a directory account) and a user ID that can be a company email address or an Azure AD GUID.

Less obvious traces: settings.xml keeps a list of revision save IDs (rsid), one random value per editing session, and the same values are stamped on paragraphs — two documents sharing rsids came from the same source. custom.xml often contains SharePoint content-type IDs and Microsoft Information Protection labels. PowerPoint stores a JPEG preview of the first slide in docProps/thumbnail.jpeg by default, and Word does so when “Save thumbnail” is ticked; a preview made before the last edit can show text that was later removed.

Excel adds printerSettings binaries with the name of the printer, and external links whose relationship targets can be absolute paths such as file:///C:/Users/mart.lepik/Budgets/2025.xlsx. PowerPoint keeps comment authors in ppt/commentAuthors.xml. In all three formats, embedded photos in the media folder keep whatever EXIF they had when inserted.

File → Info in Office shows a subset: author, last modified by, dates, total editing time and the template. To see everything, make a copy, rename it to .zip and open the docProps folder and word/comments.xml in any text editor. ExifTool also reads Office files (exiftool report.docx) and prints the same properties with their XML names.

MetaBroom does the unzipping for you and lists the fields side by side: creator, last modified by, revision, dates, company, template, editing time, custom properties, comment and change authors, the people list, rsid count, printer settings and any file paths found in links.

Office's own tool is the Document Inspector (File → Info → Check for Issues → Inspect Document). Ticking “Document Properties and Personal Information” removes core.xml values and replaces reviewer names with “Author”; it also offers to delete comments and revisions outright. LibreOffice has a quieter option under Tools → Options → LibreOffice → Security → Options: “Remove personal information on saving”. MetaBroom rewrites core.xml and app.xml with blanks, deletes custom.xml and thumbnails, drops printer settings, and can blank the author and date on every comment and tracked change, empty the people list and remove rsids — the text, formatting, sheets and slides are left exactly as they were.

No cleaner can fix what is in the content itself. Names in headers and footers, a signature block, hidden text, field codes and the EXIF inside embedded photos are part of the document, not of its metadata. If the comments or tracked changes must not be seen, accept or delete them first. And remember that exporting to PDF copies title and author into the PDF's own metadata — check the export too.