Pages, Numbers and Keynote documents are zip bundles that hold two things no mainstream metadata tool reads: a list of every version of the app that ever saved the file, and the screen resolution of the Mac the document was last saved on. Together they reconstruct how long a document was worked on, across how many sessions, and fingerprint the machine it was made on - detail that a single modification date hides.
Scan a iWork (Pages, Numbers, Keynote) fileThe distinctive find is the edit history. Inside the bundle, buildVersionHistory.plist records every application build that has ever saved the document. A scan turns that into how many separate application builds touched the file and the span of dates between the first and last, which reconstructs how long it has genuinely been worked on. The reference tool sees none of this - it reports only the zip entries' filenames, CRCs and timestamps, and never opens the history file - so this trail is effectively invisible elsewhere.
The document's index also stores the size of the display it was last saved on, recorded with the window position. Screen resolution is a signal used to fingerprint browsers, and here it is written permanently into the document, alongside the window geometry. The same index carries the author name - stored inside the file, so it survives copying and renaming - plus the title, keywords, copyright, comments and any project names typed into the document properties.
Rounding it out, a rendered QuickLook preview stored inside shows the document as it looked when saved, so content deleted afterwards can survive in the preview. The bundle also exposes how many internal files it contains, the most recent modification time recorded on those files, and, for newer documents, that the content is held as Snappy-compressed protobuf in the Index/*.iwa parts rather than as XML.
This is a selection. The full field manual documents the fields read from each format.
An iWork bundle stores the author, title, keywords, copyright and comments inside the document, a list of every application build that has saved it, the screen resolution and window position of the Mac it was last saved on, a rendered preview of the content, and the internal modification times of its parts. Most of this is independent of the filename and survives copying.
Yes. Pages, Numbers and Keynote save the size of the display the document was last saved on, stored with the window position in the document index. Screen resolution is one of the signals used to fingerprint browsers and devices, and here it is written permanently into the file rather than being a fleeting session detail.
To a degree, yes. The buildVersionHistory.plist inside the bundle lists every version of the application that ever saved the file. Counting those builds and measuring the span between the earliest and latest dates reconstructs how many separate sessions went into the document and over what period - something a single modification date does not reveal.
No, not the interesting parts. ExifTool reports only the zip entries - filenames, CRCs and timestamps - and a preview image. It never opens the build-version history or the document index, so the author, title, keywords, the list of application builds and the author's screen resolution are all absent from its output. File X-Ray reads them directly in the browser.
iWork has no built-in document inspector like Word's, so the practical options are to export to PDF or another format, or to copy the content into a fresh document, which drops the accumulated build history and properties. File X-Ray shows you exactly what a bundle carries so you can decide what to strip; it reads the file rather than producing a cleaned copy.
File X-Ray reads iWork (Pages, Numbers, Keynote) files entirely in your browser - the file never leaves your device. This format is inspected, not modified. Scan a file now.