FOCA (Fingerprinting Organisations with Collected Archives) is a reconnaissance tool that extracts metadata from public documents to identify people, software, hosts, and internal naming patterns. Attackers use it for open-source intelligence, so defenders should scrub document metadata, review exposed files, and limit unnecessary publication of internal documents.
What FOCA Reveals From Public Documents
FOCA is valuable because document metadata often exposes more than the visible content. File properties can leak author names, internal project names, software versions, workstation details, and naming conventions that help an attacker map an organisation’s environment before any intrusion attempt.
That makes the tool useful for both sides: defenders can use the same logic to discover what their published files are disclosing, while attackers use it to reduce guesswork and target the most promising systems, teams, or document repositories.
How Metadata Fingerprinting Works
FOCA typically collects public files such as PDFs, Word documents, presentations, and spreadsheets, then inspects metadata fields and embedded artefacts. Those artefacts can include usernames, template paths, printer names, application traces, document history, and internal host or share references.
The value is not any single field on its own, but correlation across many files. Repeated patterns can reveal naming conventions, departments, hostnames, document workflows, and software ecosystems, which helps build a reconnaissance picture without touching internal systems directly.
Why This Kind of Reconnaissance Matters
Metadata reconnaissance can turn ordinary public content into an intelligence source. A small set of leaked filenames or author tags may reveal who works on a system, what software is in use, how internal resources are named, and which teams own sensitive services.
That information can support phishing, targeted password attacks, social engineering, infrastructure discovery, and follow-on exploitation planning. It also helps an adversary prioritise what to probe next, especially when public documents are abundant and inconsistently sanitised.
Defensive exposure is often created by routine publishing, not by a single major mistake. Internal reports, slide decks, scanned forms, and old drafts can remain publicly reachable long after they were meant to be temporary or internal-only.
Reducing Exposure From Published Files
Good hygiene starts with treating document publication as an attack-surface issue, not just a content-management task. Review public files for metadata before release, strip unnecessary properties, and avoid publishing internal drafts, templates, or documents that contain operational clues.
Security teams should also inspect the broader file estate, not only the website homepage. Shared drives, partner portals, cloud buckets, document libraries, and archived directories can all become reconnaissance sources if they are indexed or exposed.
Where document publication is unavoidable, minimise embedded metadata, standardise export settings, and validate that the final file matches the intended disclosure level. The Attack Surface Management Guide is useful here because FOCA-style discovery is really a form of exposed asset and exposed content mapping.
Risk and Threat Considerations
Public document metadata creates a low-cost reconnaissance path for attackers because it can expose internal identifiers without triggering perimeter defences. The risk is cumulative: a single file may seem harmless, but repeated leaks can reveal enough detail to support targeted intrusion planning, pretexting, or infrastructure discovery.
Failure mechanism: Metadata and embedded document artefacts survive routine publishing workflows, then remain accessible through public websites, document repositories, search engines, or cached copies. Attackers collect and correlate those artefacts to infer people, software, hosts, and naming patterns.
Impact: The organisation may unintentionally disclose operational context that accelerates targeted phishing, host identification, software profiling, and selective probing of likely weak points.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack surface, CIS Controls v8, NIST CSF 2.0 and OWASP ASVS set the technical controls, and ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CIS Controls v8 | CIS-5 — Account Management | FOCA exposes internal names and document traces that help attackers map accounts and teams. |
| Recommendation — Review public document publishing so internal naming, authorship and software traces are removed before release. | ||
| NIST CSF 2.0 | ID.AM-07 — Cybersecurity Supply Chain Risk Management | Public files are part of the external attack surface that must be inventoried and governed. |
| Recommendation — Inventory externally published document sources and reduce unnecessary exposure across hosted content. | ||
| ISO/IEC 27001:2022 | A.8.12 — Data leakage prevention | FOCA-style collection exploits metadata leakage from publicly shared documents. |
| Recommendation — Apply data leakage prevention controls to strip sensitive metadata from files before publication. | ||
| OWASP ASVS | V14 — Data Protection | Document metadata can disclose sensitive internal information that should not be released. |
| Recommendation — Verify that published documents do not expose unnecessary metadata, embedded paths or author details. | ||
| MITRE ATT&CK | T1087 — Account Discovery | Metadata can reveal usernames and internal identities that support account discovery. |
| Recommendation — Hunt for exposed document metadata that reveals usernames, hostnames or naming conventions. | ||
Practitioner Guidance
What to watch for: Pay attention to document types that are repeatedly published in bulk, especially exports from office suites, scanners, collaboration tools, and CMS workflows. These are common sources of forgotten metadata and internal naming leakage.
Governance implication: Make metadata review part of the publication process, and assign ownership for document hygiene the same way you would for web content or exposed services. The Data Exfiltration Guide is also relevant because the same collection mindset used by attackers can be used defensively to understand what has been disclosed and how far it has spread.
Related resources from NHI Mgmt Group
- Who is accountable for how device fingerprinting data is collected and used?
- What breaks when organisations treat access logs as passive archives?
- How can organisations tell if device fingerprinting is working?
- What should organisations do when forensic archives must satisfy compliance requirements?