A photo file usually stores more than the picture: the camera and its settings, the date and time, and often the coordinates where the shutter fired. A PDF stores an author name, the software that produced it, and creation and modification times. Removing those records is a separate step from covering what the page shows.
What is stored inside a photo file?
More than most people expect, and you can see it without any special software. Apple's Photos app lists what it reads out of an ordinary file: camera metadata such as lens and shutter speed, the date or time the photo was taken, what device captured it, and where it was taken, with a link that opens the spot in Maps.
Other formats carry the same idea in their own containers. The PNG specification defines chunks for text records, for an Exif block holding details such as shutter speed and aperture, and for the time the image was last modified. It calls them ancillary, meaning a viewer can ignore them and still display the picture correctly.
Ancillary is the word that matters. These records sit beside the image rather than in it. They do not render, they do not affect what you see, and they travel with the file wherever it goes.
What is stored inside a PDF?
A set of document properties: a title, an author, a subject, keywords, the application that created the document, the software that wrote the file, and creation and modification times. The author field is usually whichever account was signed in when the file was made, which on a work machine is often somebody's full name.
Office documents carry the same kind of record, and Microsoft documents a Document Inspector that finds and removes document properties and the user name along with comments, revision marks, and hidden text. Its own page warns that what it removes is not always restorable, which is a good reason to keep the original and work on a copy.
Does covering the page remove the metadata?
No, and this is the part that catches people out. They are two layers. Drawing a box over an address changes what the page shows; it does not touch the author field or the capture coordinates. Cropping a photo to remove a face changes the pixels; the location can survive that crop, because it was never part of the picture in the first place.
This is why serious redaction workflows treat the two separately. Adobe's guidance distinguishes marking content from applying redactions and directs you to remove hidden information from the released PDF as its own step.
Why does this matter on a record you are about to share?
Because a location and a timestamp identify a person on their own. The Safe Harbor method asks you to remove its listed identifier categories, which include geographic subdivisions and dates connected to an individual, and to have no actual knowledge that what remains could still identify the person.
A photographed intake form carries both categories in the file itself. You can cover every visible field on that page, look at the result, and reasonably believe you are finished, while the coordinates of the clinic and the minute the picture was taken are still sitting in the file you are about to attach.
Which records live where?
| Record | Where it lives | Changed by covering the page | Removed by stripping metadata |
|---|---|---|---|
| Names and numbers you can read | The image pixels or the page content | Yes | No |
| Camera, lens, and exposure | An Exif block beside the image | No | Yes |
| Capture date and time | An Exif block, and a PNG modification-time chunk | No | Yes |
| Capture location | Exif location tags | No | Yes |
| Author and creating software | PDF document properties | No | Yes |
| The file name | The file system, not the file | No | No |
How do you remove it?
For an Office file, the Document Inspector above is the supported route. For a PDF, a reader's own document properties panel will show you what is there and often let you clear it.
For a photo, the common advice is to open it in an editor and export it again, which does drop the records as a side effect. It also re-encodes the picture, so a JPEG loses a little quality on every pass. Removing the records without touching the encoded image avoids that: the picture that comes out is byte for byte the picture that went in.
Where does PHI Mask fit?
Two steps, in that order. Open the metadata remover to see what a JPEG, PNG, or PDF is carrying and download a copy without those records. Then open the masker to cover what the page itself shows. The first works on the records beside the content; the second works on the content.
Neither step reads the file name, and neither one judges whether the remaining picture still identifies someone. Rename the copy if its name carries a person, and look at what the page shows before it goes anywhere.
Review before sharing.
Sources and review notes
Reviewed against the PNG specification published by the Web consortium, Apple's photo information guide, Microsoft's Document Inspector documentation, Adobe's redaction and sanitization guidance, and the HHS de-identification guidance.
Common questions
- Does a photo really contain my location?
- It can. Apple's Photos app shows where a photo or video was taken and links the spot into Maps, which is that record being read back out of an ordinary file. Whether it is there depends on the device and its location setting at the time.
- Does cropping a photo remove the metadata?
- Not on its own. Cropping changes pixels. The capture time, the camera, and the location sit in a separate block beside the image and survive any edit that only touches the picture.
- Does a screenshot carry metadata?
- Less of it. A screenshot has no camera or lens and usually no coordinates, but it can still carry the time it was taken and the name of the software that wrote it.
- What is in a PDF's metadata?
- A title, an author, a subject, keywords, the application that created the document, the software that wrote the file, and creation and modification times. The author field is often whichever account was signed in at the time.
- Is removing metadata the same as redacting?
- No. Redaction removes content from the page a reader sees. Stripping metadata removes records stored beside that content. A document headed outside usually needs both.
- Does the file name matter?
- Yes, and nothing that edits the inside of a file changes it. A name carrying a surname or a record number travels with the copy you send, so rename it before you share it.