# File Forensics

Examine what a file claims about itself and what it actually contains, powered by...

- Repository: https://github.com/apache/tika (4119 stars)
- Category: Documents
- License: Apache-2.0
- Last updated: 2026-11-01
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add apache/tika --skill file-forensics -g -a claude-code -y`
Codex: `npx skills add apache/tika --skill file-forensics -g -a codex -y`
Cursor: `npx skills add apache/tika --skill file-forensics -g -a cursor -y`
Gemini CLI: `npx skills add apache/tika --skill file-forensics -g -a gemini-cli -y`

## Description

Examine what a file claims about itself and what it actually contains, powered by Apache Tika. True content-based type detection (extensions lie), provenance claims (authors, dates, creating application), revision and tamper signals (PDF incremental updates, tracked changes, hidden slides, zip integrity), hidden and embedded content (attachments, macros), risk indicators (PDF JavaScript actions, encryption), and content digests. Evidence gathering, not verdicts: Tika reports what the file asserts and what parsing observed; it does not attribute authorship or validate signatures. Use for triaging suspicious files, provenance questions, e-discovery-style review, or "is this file what it claims to be.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

<!--
Licensed to the Apache Software Foundation (ASF) under one or more
contributor license agreements.  See the NOTICE file distributed with
this work for additional information regarding copyright ownership.
The ASF licenses this file to You under the Apache License, Version 2.0
(the "License"); you may not use this file except in compliance with
the License.  You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
-->

Local override: `$TIKA_SKILLS_LOCAL/file-forensics/LOCAL.md` (default `~/.tika-skills`),
read after this file, wins on conflict.

# File forensics with Apache Tika

**What this can and cannot tell you.** Tika cannot tell you who wrote a
file. It can tell you, exhaustively, what the file *claims* about itself
and what it actually *contains*, and those claims are the evidence: a
`dc:creator` value is an assertion some software recorded, not an identity;
a template-default author, an inconsistency between claimed dates, or a
conspicuously *missing* field is as much a finding as a present one. Report
what the file says; let the human draw conclusions.

**The one rule for reading Tika's output:** the key prefix tells you *who is
asserting each fact*.

- **`tk:*`**, Tika's own parse-time observations, which the file cannot
  forge into place: magic-byte-detected type, embedded-item structure,
  encryption status, digests of the actual bytes.
- **Everything else** (`dc:`, `pdf:docinfo:`, `extended-properties:`,
  `xmp:`, ...), the file's claims about itself, recorded by whatever
  software touched it, editable by anyone with a hex editor.

Disagreement between the two classes is where findings live.

The rest: https://github.com/apache/tika/blob/HEAD/.skills/users/file-forensics/SKILL.md