How to check a PDF is properly redacted

How a redacted PDF can still leak

A PDF looks like a printed page, but inside it is a stack of separate things: text, pictures, drawn shapes, comments, form fields, attachments, and a block of information about the file itself. A redaction only works if it removes the words from every one of those places. Leaks usually come from one of these:

• A box drawn on top. A black rectangle or black highlight sits over text that is still there. It can be copied, searched or simply deleted.
• An invisible text layer. Scanned pages often carry hidden text from character recognition (OCR), so the scan can be searched. Blacking out the picture leaves that layer untouched.
• The same detail elsewhere. The name boxed in the address block also sits in a footer, a page header, a file name or on page 6.
• Hidden data. The author, the title, comments, form fields, bookmarks and attached files can all repeat what was boxed.
• Earlier versions. Some editors save changes by adding them to the end of the file, so the version before the redaction can still be inside it.

The tests below catch each of these. They take about five minutes, and you can run them on a file you are about to send or one you have been sent.

Seven tests to check a redacted PDF

1. Copy and paste everything. Open the PDF, press Ctrl+A (⌘+A on a Mac), copy, and paste into a plain note. If a hidden word appears in the pasted text, the redaction failed. On a page that was properly rebuilt, nothing from that page pastes at all.
2. Search for each hidden word. Use the viewer’s Find (Ctrl+F) for the names, numbers and addresses that should be gone. Search for parts too: a surname alone, the last four digits of an account number, a postcode without its space.
3. Try to select under a box. Drag across a black bar as if selecting text. If a highlight appears through or around it, there is text underneath.
4. Look at the comments and attachments panels. Most PDF viewers have a sidebar for comments, attachments and bookmarks. Each should be empty, or hold nothing you meant to hide.
5. Check the document properties. Open File › Properties (or Document Properties). The title, author, subject and keywords can repeat a client’s name or a case reference.
6. Check form fields. Click into any boxes that look like form fields. A field can hold a typed value that is hidden behind a black shape.
7. Zoom in on every box. At 400% or more, look for the tops of tall letters or the tails of low ones showing above and below the bar, and for an outline of the text showing through a dark grey box.

How Redact checks its own work

Redact runs these checks for you every time it saves. After it rebuilds each page that has a box as a picture (with the boxes burned in) and copies the other pages without their comments, links and form fields, it opens the saved file again and searches:

• the saved file’s text, for every word that was under one of your boxes;
• the file’s raw bytes, for every such word of six characters or more (shorter ones turn up by chance inside compressed data);
• what each rebuilt page still shows outside your boxes, so a name you boxed once but missed lower down the same page is caught too.

It then tells you either that none of the redacted words can be found in the saved file, or which ones are still readable and on which pages, and it doesn’t call the job done. It also lists the hidden data it removed from the original, such as the author, the software that made the file, XMP metadata, attachments, scripts, comments and form fields.

What no tool can check is the thing you never boxed. If you didn’t realise a reference number identifies someone, the check won’t know either. Read the saved file once, page by page, as the person receiving it.

Checking a PDF someone else redacted

If you have received a redacted document and want to know whether it was done properly, run the seven tests above. Two quick ways in Redact:

• Open the file and use Find to search for a word you can still see near a box. If Find lists a match for a word you can only see as a black bar, the text is still under it.
• Tick the personal details in Find (emails, phone numbers, card numbers, IBANs, sort codes and account numbers, National Insurance and Social Security numbers) to see whether any are still in the text where you can’t see them.

If you find a leak in a document sent to you, tell the sender so they can send a corrected copy, and don’t pass the file on.

The trade-off: redacted pages can’t be searched

Rebuilding a page as a picture is what makes the redaction safe, and it has one cost: none of the text on that page can be selected or searched any more, not just the words you boxed. Pages without boxes keep their text. If the recipient needs searchable pages, keep the boxed pages to the minimum, or send the unredacted pages as they are.