FOCA & The Metadata Leak: Why Your Business Documents Are an OSINT Goldmine
• BizVuln Staff
Discover how FOCA extracts hidden metadata from business documents. A deep dive into OSINT risks, real-world leaks, and how to protect your enterprise in 2026.
FOCA & The Metadata Leak: Why Your Business Documents Are an OSINT Goldmine
Introduction: The Invisible Footprint of Every .docx and .pdf
In the world of reconnaissance, the most valuable intelligence often isn't hidden behind a firewall or encrypted in a database. It is sitting, quietly, in the metadata of a publicly available PDF on your website, a Word document attached to a support ticket, or a PowerPoint slide shared on a partner portal.
As of 2026, the attack surface has expanded beyond APIs and cloud misconfigurations. It has regressed to the most fundamental unit of business communication: the document. And the tool that weaponizes this vector better than any other is FOCA (Fingerprinting Organizations with Collected Archives).
FOCA is not new, but its relevance in the current threat landscape is surging. With the proliferation of hybrid work, automated document generation, and the sheer volume of digital paperwork, the metadata embedded in your company’s files is a reconnaissance goldmine. This blog post will dissect exactly what FOCA reveals, why your organization is likely bleeding data, and how to stop the leak.
---
H2: The Anatomy of FOCA: More Than Just a Metadata Extractor
FOCA is an open-source tool developed by the security firm ElevenPaths. While often categorized as a metadata extraction tool, that description severely undersells its capability. FOCA is a Document Intelligence Engine designed for OSINT (Open Source Intelligence) and reconnaissance.
H3: How FOCA Works: The Search-and-Extract Pipeline
FOCA operates in a three-phase pipeline that makes it uniquely dangerous in the hands of a red teamer or a malicious actor.
1. Discovery (The Crawl): FOCA uses search engines (Google, Bing, and DuckDuckGo) and its own spidering capabilities to find documents associated with a target domain. It searches for specific file extensions: `.doc`, `.docx`, `.xls`, `.xlsx`, `.ppt`, `.pptx`, `.pdf`, and even `.odt`. The tool can be configured to search for documents on the target’s main domain, subdomains, and even related file-sharing sites.
2. Download (The Harvest): Once located, FOCA downloads the documents locally. It does not simply scan the URL; it pulls the entire binary file. This is critical because metadata is often stripped when a document is rendered in a browser viewer but remains intact in the raw file.
3. Analysis (The Extraction): This is where the magic happens. FOCA parses the file structure to extract:
- **Standard Metadata:** Author, creation date, last saved by, software version.
- **Hidden Data:** Revision history, comments, tracked changes, and hidden text.
- **Network Paths:** Local file paths (e.g., `C:\Users\CEO\Desktop\...` or `\\NAS-SERVER\Finance\...`).
- **Printer Paths:** The exact model and path of the printer used to create the file.
- **Email Addresses:** Extracted from the author field, comments, and even the body of the document.
H3: Why 2026 Makes FOCA Especially Dangerous
The threat landscape has evolved. In 2026, we are seeing three major trends that amplify the risk of FOCA-based attacks:
- **The "Shadow IT" Document Boom:** Employees are generating more documents than ever using unsanctioned tools. A salesperson might export a CRM report as a PDF and upload it to a public drive. That PDF contains the database server name in its metadata.
- **AI-Generated Document Metadata:** AI tools (like Copilot or Gemini) embed unique model identifiers and prompt history into document metadata. FOCA can now fingerprint which AI tools a company uses, revealing potential supply chain vulnerabilities.
- **The "Click-to-Run" Exploit:** Advanced attackers are using metadata to find software versions. If FOCA reveals a document was created with "Microsoft Office 2016," the attacker knows the target is likely vulnerable to specific legacy CVEs.
---
H2: What FOCA Actually Reveals: The Five Critical Data Leaks
Understanding what FOCA finds is the first step to remediation. Here are the five most dangerous data points FOCA can extract from your business documents.
H3: 1. Internal Network Architecture (The "SMB Leak")
This is the crown jewel for an attacker. When a user saves a document from a network drive, the full UNC path is often embedded in the metadata.
Example Extraction:
`\\corp-fs-01\shared\finance\Q4_Projections.xlsx`
What an Attacker Does:
- **Enumeration:** The attacker now knows the naming convention for your file servers (`corp-fs-01`). They can infer the existence of `corp-db-01` or `corp-app-01`.
- **SMB Relay Attack:** If the attacker can trick a user into connecting to a malicious SMB share (via a link in a phishing email), they can capture the user's NTLM hash. The metadata provides the legitimate server name, making the phishing pretext more believable.
H3: 2. User Behavior and Role Mapping
FOCA extracts the "Author" and "Last Saved By" fields. In a large organization, this is a role-mapping tool.
Example Extraction:
- Author: `jdoe`
- Last Saved By: `jdoe`
- Company: `Acme Corp`
What an Attacker Does:
- **Spear Phishing:** The attacker now knows that `jdoe` creates financial documents. They can craft a highly targeted email to `[email protected]` referencing a specific financial report.
- **Privilege Escalation:** If the attacker compromises `jdoe`'s machine, they know exactly which network shares to access based on the paths found in the documents.
H3: 3. Software and OS Version Fingerprinting
Every document created in Microsoft Office stores the exact version of the software and the operating system.
Example Extraction:
- Application: `Microsoft Office 2021`
- OS: `Windows 10 Enterprise 22H2`
- Printer: `HP LaserJet M507 via \\print-srv-02`
What an Attacker Does:
- **Vulnerability Targeting:** "Windows 10 22H2" has a known set of CVEs. The attacker can focus their exploit efforts on vulnerabilities that specifically affect that build.
- **Printer Exploitation:** The printer model and path are revealed. Attackers can attempt to exploit the printer's web interface or use it as a pivot point on the network.
H3: 4. Hidden Revision History and Comments
This is the "smoking gun" data. FOCA can extract comments, tracked changes, and revision history that the author thought was deleted.
Example Extraction:
- Comment: `"John, please update the revenue figures. The board meeting is tomorrow."`
- Revision: `"Deleted sensitive client list from slide 12."`
What an Attacker Does:
- **Corporate Espionage:** The attacker now has insider chatter about board meetings, pending acquisitions, or client lists.
- **Social Engineering:** The attacker can use the language and tone of the comments to impersonate a colleague.
H3: 5. Email and Personal Identifiable Information (PII)
Beyond the author field, FOCA scans the entire document body for email patterns.
Example Extraction:
What an Attacker Does:
- **Credential Harvesting:** These emails are fed into credential-stuffing databases.
- **Third-Party Attacks:** The attacker now has a list of your vendors and partners. They can target the weaker security of the vendor to gain access to your network.
---
H2: Actionable Checklist: How to Defend Against FOCA
Defending against FOCA is not about blocking the tool (you can't). It is about metadata hygiene. Here is a checklist for your security team.
H3: The "Metadata Sanitization" Protocol
- [ ] **Implement a Document Sanitizer:** Use tools like Microsoft Purview Information Protection, BeCyPDFMetaEdit, or custom PowerShell scripts to strip metadata from all documents *before* they are uploaded to public-facing portals.
- [ ] **Disable "Save AutoRecover Info" in Group Policy:** This prevents the storage of network paths in Office documents.
- [ ] **Use "Inspect Document" Feature:** Train users to use the "File > Info > Check for Issues > Inspect Document" feature in Office. This removes hidden metadata, comments, and personal information.
- [ ] **Convert to PDF with Metadata Removal:** When sharing externally, convert documents to PDF using a tool that explicitly strips metadata. Do not rely on "Save as PDF" alone.
H3: The "Document Hygiene" Audit Checklist
- [ ] **Scan Your Public Surface:** Run FOCA against your own domain. Identify every document that is publicly accessible. You will be shocked at what you find.
- [ ] **Review Third-Party Portals:** Check partner portals, support ticket systems, and file-sharing sites. Documents uploaded there often lack metadata controls.
- [ ] **Enforce a "No Network Paths" Policy:** Educate users on the dangers of saving files directly to network shares and then sharing them externally. Use a staging area or a secure file transfer solution.
- [ ] **Partner with ZoeSquad for Remediation:** If your FOCA scan reveals significant exposure, you need a remediation partner. **ZoeSquad** specializes in rapid IT remediation and can help you deploy enterprise-grade metadata stripping tools, harden your document management policies, and train your staff on secure document handling.
H3: The "Zero Trust Document" Workflow
1. Create: Author creates document in a controlled environment.
2. Sanitize: Document passes through an automated metadata scrubber.
3. Approve: Security team or DLP tool approves the sanitized version.
4. Publish: Only the sanitized version is uploaded to the web or shared externally.
---
H2: FAQ: FOCA and Metadata Security
Q1: Is FOCA illegal to use?
No. FOCA is a legitimate security tool used by penetration testers, red teams, and security researchers. However, using FOCA to extract metadata from documents without the owner's permission for malicious purposes (e.g., corporate espionage) is illegal under the Computer Fraud and Abuse Act (CFAA) and similar laws globally.
Q2: Can FOCA extract metadata from scanned PDFs?
Partially. A scanned PDF is essentially an image. FOCA cannot extract "hidden text" from the image itself, but it *can* extract metadata from the PDF container (e.g., scanner model, software used to create the PDF, author). If the PDF has an underlying OCR layer, FOCA can extract that text.
Q3: Does cloud storage (Google Drive, SharePoint) protect against metadata leaks?
Not inherently. When you download a file from SharePoint or Google Drive, you often get the raw file with all metadata intact. Some enterprise-grade DLP solutions can strip metadata on download, but this is not a default feature. You must configure it.
Q4: How often should I run a FOCA scan on my own domain?
At least quarterly. New documents are uploaded to your website and portals every day. A quarterly scan ensures you catch new leaks before they are exploited. After any major document migration or software update, perform an immediate scan.
Q5: What is the single most effective fix for metadata leaks?
Training and Automation. You cannot rely on users to remember to strip metadata. The single most effective fix is an automated policy that scrubs all documents leaving your internal network. This is where a partner like ZoeSquad can implement a "metadata loss prevention" gateway.
---
Conclusion: The Document is the New Perimeter
In 2026, the perimeter is not the firewall. It is not the VPN. It is the `.docx` file attached to an email and the `.pdf` on your careers page. FOCA is the tool that exposes this reality. It reveals that your internal network architecture, your user roles, your software vulnerabilities, and your confidential conversations are often hiding in plain sight.
The good news is that the fix is straightforward. It requires a shift in mindset from "data security" to "document hygiene." By implementing automated sanitization, enforcing strict publishing workflows, and conducting regular FOCA-based audits, you can close this critical OSINT gap.
Do not let your metadata become your next breach. Scan your surface today. Remediate with purpose. And remember: in the world of OSINT, what you don't see *will* hurt you.
---
*For expert assistance in securing your document lifecycle and remediating discovered vulnerabilities, contact ZoeSquad—your partner for rapid IT remediation and security hardening.*