I don't have the resources at hand to test this, but if
either of you, or someone else, could elaborate on this, I
think a reasonable possibility exists that the listed author
may not even be the person that is logged in. From what I
read so far, it seems that this field could be more along
the lines Office metadata, which is set at the time of
install of the authoring program, and may not be the
currently logged in user (although I think Office uses this
by default, but anything can be entered). For example, I
can install office while logged in as Bob, but type George
in for my name, initials, etc. when Office starts for the
first time, and this George value will be used for the
author metadata field. This sounds quite similar.
Bob
-----Original Message-----
From: David MacDonald <davidpmacdonald@gmail.com>
To: NEWELL Craig -TSDC <craig.newell@torsdc.ca>
Cc: forensics@securityfocus.com
Date: Wed, 1 Jun 2005 13:55:17 -0300
Subject: Re: Determining author from PDF
Craig,
Opening up a number of PDF's that I've created I just
see my name
with none of the backslashes or numbers (could be caused
by the
Producer version). i.e:
/CreationDate (D:20050526091500-03'00')
/ModDate (D:20050526091500-03'00')
/Producer (Acrobat Distiller 5.0.5 \(Windows\))
/Author (Dave)
But to answer your question the author field is the
person who
created the PDF.
Dave
On 5/31/05, NEWELL Craig -TSDC <craig.newell@torsdc.ca>
wrote:
Hi,
When we open up a PDF in WordPad, we find an entry as
follows:
/Creator (Acrobat Capture Server 2.01)
/CreationDate (D:20050207111015)
/Author
(\376\377\000C\000L\000O\000W\000E\000S\000D\000A)
/Producer (Acrobat PDFWriter 4.05 for Windows NT)
/ModDate (D:20050207111015)
We are trying to find the creator of the PDF and if we
look at the
author field, we get CLOWESDA. Is this the userid that
was logged in?
Cheers,
Craig Newell, CISSP
TSDC Security
New Horizon System Solutions/Inergi LP*
Toronto Service Delivery Centre
p: (416) 592-6723
c: (416) 992-2818
craig.newell@torsdc.ca
700 University Avenue, H2 F7
Toronto, Ontario M5G 1X6
* A member of Capgemini
---------------------------------------------------------
--------
This list is provided by the SecurityFocus ARIS
analyzer service.
For more information on this free incident handling,
management
and tracking system please see:
http://aris.securityfocus.com
---------------------------------------------------------
--------
This list is provided by the SecurityFocus ARIS analyzer
service.
For more information on this free incident handling,
management
and tracking system please see:
http://aris.securityfocus.com
-----------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management
and tracking system please see: http://aris.securityfocus.com
