EPUB is the open e-book format used by most stores other than Kindle. Two things make its metadata worth a look: a purchased copy is often locked to a single Adobe account whose ID is identical across every book that person bought, and a file exported from a calibre library carries that reader's private catalogue - their series, ratings and tags - which describe the collection rather than the book. Even the cover image can still carry the GPS and camera details of the photo it was made from.
Scan a EPUB fileThe most identifying thing a purchased EPUB carries is its DRM licence. An Adobe ADEPT rights.xml file is issued to one Adobe ID, so the book can be traced back to the account that bought or borrowed it and will not open on a device signed in to anyone else. A scan reads that account ID - which is the same across every book the person acquired - along with the resource ID that links the file to a specific transaction and the date the licence was issued. Font obfuscation, which uses the same encryption mechanism but is not DRM, is distinguished from true encryption rather than lumped in with it.
Files that came out of a personal library betray the library, not the book. Calibre writes its own organisation into the metadata: series names, star ratings, user categories and the filing form of the title, from the collection the file was exported from, plus a timestamp of when calibre processed it. It also stamps a library UUID that follows the whole collection, so two files carrying the same value came from the same person. An EPUB routinely holds several identifiers at once - the package UUID, an ISBN and calibre's UUID - and a scan reports each, because the per-file ones can match this copy against another.
If the package is signed, the certificate is read for the actual identity rather than merely noting that a signature exists. That surfaces the signer's name and organisation, the signing algorithm (flagged when it relies on a hash no longer considered sound), and the time the book was signed, taken from the signature itself.
The bibliographic layer names people. Every author (dc:creator) is listed, contributors are labelled with their role - editor, translator, illustrator - where the file records one, and a sort name gives the surname-first legal form when it differs from the display name. The source field can name a local path or the previous format the book was converted from. And the cover image is run through the full image parser in its own right, so any latitude and longitude, camera make, model or serial, and capture date embedded in the cover photo surface as their own fields - metadata that stripping the book's own properties would never touch.
This is a selection. The full field manual documents the fields read from each format.
An EPUB stores its title, authors and contributors with their roles, publisher, language, publication date and one or more identifiers (package UUID, ISBN, and sometimes a calibre library UUID). A purchased copy can carry an Adobe DRM licence naming the account it was issued to, a file from a personal library carries calibre's own organisation data, and the cover image can retain its own EXIF, GPS and camera details.
Potentially in several ways. An Adobe DRM licence names the account that bought or borrowed it and is the same across all your books; a calibre-exported file carries a library UUID and your private series, ratings and tags; a signed package names the signer; and the per-file identifiers can match one copy against another. None of that is visible in a normal reader.
Open the .epub in File X-Ray and it reads the META-INF/rights.xml licence in the browser, reporting whether the book is locked to an Adobe account and showing the account ID, the licensed resource ID and the date the licence was issued - without uploading the file anywhere. It also distinguishes real DRM from harmless font obfuscation.
It can. The cover is a normal image file inside the package, and if it was made from a geotagged photo it keeps that photo's latitude and longitude, camera make, model and serial, and capture timestamps. File X-Ray runs the cover through its image parser and reports those as separate 'Cover Image:' fields, because stripping the book's own metadata never touches them.
Calibre's 'Edit metadata' and the Sigil ebook editor can rewrite the OPF and remove the bibliographic fields and calibre's library data. DRM is different: an Adobe account lock is the whole point of the DRM and cannot simply be edited out - that is what ties the file to the buyer. File X-Ray shows you what is present so you know what to change; it reads the file rather than producing a stripped copy.
File X-Ray reads EPUB files entirely in your browser - the file never leaves your device. For this format you can also download a clean copy with the metadata removed. Scan a file now.