Document Tracking: How to Know Who Shared Your File

What people mean by document tracking

When someone searches for document tracking, they usually want one of three answers:

1. Did they open it? You sent a proposal or a pitch deck and want to know if anyone read it.
2. Can I control access? You want to expire a link, block downloads, or revoke someone later.
3. Who leaked it? A file you sent to a few people turned up in a group chat, a forum or a competitor's inbox, and you want to know whose copy it was.

The first two are about the file while it's still in your hands. The third is about the file after it's gone. Different tools answer each one.

Two ways to track a document

Link tracking is great for knowing who read your proposal and for cutting off access later. Its blind spot is everything that happens outside the viewer: a downloaded PDF, a printout, a phone photo of the screen, or a screenshot pasted into a chat. A link can also be forwarded, and the viewer may only know which link was used, not who was holding the phone.

Copy tracking doesn't tell you who opened anything. It answers a different question: when a copy shows up where it shouldn't, which recipient's copy was it? Because the mark is inside the file (in the pixels of an image or the page of a PDF), it can survive the file leaving your system.

Many teams use both: a tracked link for the first look, and a marked copy when the real file has to be sent.

Low-tech ways people try to track documents

Before buying anything, it helps to know the usual tricks and where they break:

• Different file names per person. Easy, and gone the moment someone renames the file or takes a screenshot.
• Document metadata (author, PDF properties). Stripped by most chat apps, by "print to PDF", and by any screenshot.
• A visible name stamp ("Prepared for Alex"). It makes people think twice, but it can be cropped or painted out, and it's obvious, so a careful leaker removes it first.
• Changing a few words for each recipient (sometimes called a canary trap). It can work for text that gets copied word for word. It's slow to do by hand, it doesn't help with images, and a paraphrase or a summary breaks it.
• Email and DLP logs. They show who sent what inside your company. They don't see what happens on a recipient's personal phone.

None of these is useless, but each one depends on the leaker not noticing or not bothering. An invisible mark per copy is harder to remove because there's nothing obvious to remove.

How to track who shared your file, step by step

1. List who gets the file. One copy per person or per organization, never one shared copy for a whole group.
2. Mark each copy for its recipient before you send it. Keep the record of who got which copy.
3. Send the copies through your normal channel: email, chat, a shared drive.
4. If it leaks, keep what you found. Save the original file, screenshot or image exactly as you received it, with the date and where you found it. Don't re-crop or edit it.
5. Check it against your records. A detection tool compares the leaked file with the copies you made and tells you which one it matches, with a confidence score.
6. Treat the result as a lead. A match points to a copy, not to a person. Someone may have had their device or account used by someone else. Use it to start a careful conversation, and talk to a lawyer before taking legal action.

For PDFs specifically, see how to trace a leaked PDF. For screenshots, see can a screenshot be traced back to its source.

What survives, honestly

No method survives everything. Here's what to expect from a forensic watermark, using Markedfile's published limits as an example:

• Confidence scores, not guarantees. About 99% for the exact file, 95% from the signed metadata mark alone, and up to 85% for a re-saved JPEG or a screenshot, where only the visual pattern is left. These are reported scores, not guaranteed detection.
• What we measured (v3 detection, internal tests). 0 wrong attributions in our tests, including 20,000 reads with the wrong key and over 9,000 additional reads in independent verification runs. Screenshots were traced in 25 of 27 test cases (19 of 27 in the previous version), and 113 to 116 of 128 cases across our full test corpus (105 to 106 before). By format: 58 of 60 PDF cases and 53 of 60 PNG/JPEG cases. Video now traces 15 of 18 cases. These are results from our own test sets, not guaranteed detection.
• Crops have floors. Files you mark need to be at least 128×128 px. On a best-effort basis, a crop needs about 224 px of a detailed photo, about 192 px of a flat diagram, or about 120 px of flat gray or near-black; irregular textures can need about 256 px. The smallest crop we read in our tests was about 120×120 px.
• PDF screenshots need enough of the page. On a best-effort basis, in our own v3 tests: about 160 pt of a photo, 320 pt of a slide, 200 pt of a ticket, or the top half of a text page. If you have the leaked PDF itself, upload the PDF rather than a screenshot.
• Retyped text isn't traceable. If someone copies the words into a new document, the mark doesn't come with them.
• Video is on Pro and above (Pro: up to 5 active videos, each up to 10 minutes and 100 MB).
• Re-mark older files. Files marked with the previous version of the mark are no longer detected, so re-mark anything you still share. A screenshot of a video frame isn't detected as an image; upload the video file itself.
• On paid plans you can download an evidence report (PDF) with the marking date and the file's SHA-256. It isn't a legal document.

Where Markedfile fits

Markedfile does copy tracking: you upload a file, create one invisibly marked copy per recipient, and if a copy leaks, you upload what you found to see which recipient's copy it matches. It works with images and PDFs, plus video on Pro and above. Files are processed in memory and their contents aren't stored. It doesn't do link analytics, view tracking or access revoking, so if you need to know who opened a deck, pair it with a link-sharing tool.

It started because the team behind it needed to mark files before sharing them, such as PDFs and photos sent for identity verification, and couldn't find a self-serve tool that did it. The Free plan lets you protect up to 5 files at a time, detectable for 6 months; paid plans and limits are on /pricing. If you mark files from your own system, the API is on Business and Enterprise.

FAQ

Can I see who opened a PDF I emailed? Not reliably. Once a PDF is attached to an email, it's a file on the recipient's device. Some read-tracking tricks exist, but many email apps and PDF readers block them. If you need open tracking, share a link through a viewer instead of attaching the file.

Can I find out who shared my document? Only if each person got a copy that can be told apart. If everyone received the same file, there's nothing to compare. Marking one copy per recipient before sending is what makes the question answerable.

Does document tracking work after a screenshot? Link tracking doesn't. A forensic watermark often does, if the screenshot keeps enough of the image or page (see the crop and PDF limits above).

Is a tracked link enough for confidential files? It's enough for knowing who looked. It isn't enough if you're worried about a copy leaking, because a download, a printout or a photo of the screen leaves the viewer behind.

Is document tracking legal? Marking your own files before you send them is generally fine, and telling recipients that files are traceable also discourages leaks. Rules on monitoring people vary by country, so check locally if you plan to track opens or devices. This isn't legal advice.

Try Markedfile free · For businesses · What is forensic watermarking?