Everything it finds, and how it fixes it.

Remote-loaded images (web bugs)

A 1×1 invisible image hosted on the sender's server. When you open the document, it loads — and the sender learns the time, your IP address and how often you've read it. Common in Word via INCLUDEPICTURE fields and linked images.

Fix: the remote reference is removed entirely. Layout is unaffected.

Remote template injection

A Word document “attached” to a template on the internet fetches it on open — a favourite technique for both tracking and malware delivery.

Fix: the template attachment is cut; the document keeps its formatting.

PDF auto-run actions & scripts

OpenAction and /AA entries can contact a web address, run JavaScript or open another file the moment the PDF opens — no click needed. Document-level scripts in the names tree run on open in most viewers.

Fix: all automatic actions and embedded scripts are removed.

Form submission targets

PDF forms (including legacy XFA) can be wired to transmit what you type — or just the fact you opened the file — to a remote server.

Fix: submission targets are removed; the visible form stays.

Names, employers, and descriptions

• Author & Last modified by — your name, even if it's nowhere in the visible text
• Company & Manager — the classic leftover from a work computer
• Title, subject, keywords, comments — often reveal what a file was originally about
• Custom properties — SharePoint and document-management stamps with usernames and machine names

Time tells a story

• Total editing time — the 6 hours 42 minutes you actually spent on that “quick note”
• Created / modified / last printed timestamps, with timezone offsets
• Revision counter — 31 saves says more than you'd like
• Embedded preview thumbnail — can show an earlier draft, including deleted content

The hidden second copy: XMP

PDFs usually carry two copies of their metadata: the visible Info fields and a hidden XML packet (XMP). The XMP copy frequently survives “Remove properties” tools — and contains unique DocumentID chains that link every version of a file together. PDF Doc Shield reads both, shows you both, and removes both.

Leaked local file paths

Hyperlinks and file references pointing at C:\Users\chris.t\Documents\… reveal your Windows account name and folder structure. Found in Word link targets, field codes, and PDF file specifications.

GPS & camera data in photos

A phone photo pasted into a document still carries the exact coordinates where it was taken, the device model and the capture time. PDF Doc Shield reads the EXIF data and strips it — pixels untouched.

Editing-session fingerprints (RSIDs)

Word tags every editing session with random IDs. Two “unrelated” documents sharing RSIDs can be proven to come from the same machine — a real deanonymisation technique.

Document GUIDs & PDF /ID pairs

Permanent unique identifiers that survive editing and link every copy and revision of a file to its origin. Removed, or regenerated fresh for the cleaned copy.

Tracked changes & comments

Text “deleted” with Track Changes is still in the file, along with who wrote it and when. Comments carry author names and initials even with the review pane closed. Cleaning applies the changes for real and deletes the history and every reviewer identity record.

Invisible text

Text formatted as hidden doesn't print or display — but one Word setting reveals it. PDF Doc Shield shows you exactly what's hiding and removes it permanently.

PDF incremental-update history

PDFs edited with “Save” keep every previous version inside the same file — free tools can recover pages you changed or redacted. The cleaned copy is rebuilt as a single current revision, so there is no history to recover.

Files inside files

PDFs can carry whole embedded attachments you may not know you're sharing. They're detected, named, and removed.