How to Prove Who Leaked a File (and What Counts as Evidence)

Why "who leaked it" is hard

When a file shows up somewhere it shouldn't, it usually looks exactly like the copy everyone else got. A screenshot, a forwarded PDF or a re-uploaded image strips most of what could identify it: the file name, its metadata, the email it came from. Without something unique in each copy, every recipient looks the same.

That's why the work that matters happens before the leak: sending each person a copy you can tell apart later, and keeping a record of who got which one.

What you can actually establish

Think of it as layers. Each one narrows things down, and none is conclusive on its own.

1. Which copy leaked. If each recipient had a uniquely marked copy, detecting the mark tells you which copy the leaked file came from.
2. Who received that copy. Your own private list of recipient codes connects the copy to a person, team or company.
3. How it was delivered. Sent emails, share links, download logs and access records show when and how that copy went out.
4. What happened next. Who else had access to that person's inbox, device or shared folder. This is where it stops being technical.

A match covers the first layer. Your records cover the second and third. The fourth usually needs a conversation.

Records worth keeping (before anything leaks)

• A private recipient list: which code went to whom, and when.
• The sent copies themselves, or a way to regenerate them, so you can compare later.
• Delivery records: the sent email, the share link and its access log, or the upload to a data room.
• The context: NDA or terms they agreed to, if any.

Keep the list somewhere only you or your team can see. A recipient code shared in public stops being useful.

How a per-recipient mark works

An invisible forensic watermark changes the pixels in tiny ways nobody notices at normal viewing size, and each copy gets a different pattern. Because the pattern is spread across the whole image and repeated, part of it can survive a screenshot, a re-save or a crop.

With Markedfile, every supported file also carries an HMAC-signed metadata mark for that workspace. That helps when the file is shared as-is, but screenshots and many platforms strip metadata, so the visual pattern is often what's left. PNG, JPEG, and WebP images, PDFs, text files, and ZIP-based packages (including Office files) can be marked. Other binary files come back inside a marked ZIP. Text and package marks are fragile: they do not survive screenshots or content extraction. Images and PDFs carry the visual pattern.

When a match is found, Markedfile reports a confidence score: about 99% for the exact file, 95% from the metadata mark alone, and about 81% for a re-saved JPEG or a screenshot. These are reported scores, not guaranteed detection. For video on Business and Enterprise, a picture-only match stays at or below 85% confidence. Deleting the record ends detection.

What a match does and doesn't show

A recipient may have forwarded it to a colleague, lost a laptop, or had an account compromised. That's why a match is a lead you follow up, not proof of intent.

What makes a mark harder to detect

• Crops: roughly 256 px of a detailed area is the approximate minimum. Smaller or flatter areas can fail. That is a rough guide, not a ceiling.
• Small images: Images and video frames under 96×96 px are rejected; everything else uses the same pattern.
• Heavy edits: strong compression, blur, filters or retouching can destroy the mark.
• Rotations: most 90° rotations are fine. A rotation combined with strong, uneven stretching can break it.
• PDF screenshots: A PDF screenshot is best effort and is not guaranteed. Upload the PDF itself whenever you can. It can be checked if it shows the top half of a text page with margins, about 200 points square on a ticket, about 320 points square on a slide, or about 160 points square on a photograph. Dense text on its own isn't detected.
• Unmarked files: anything sent before it was marked can't be traced.

Detection is never 100%.

What to do when something leaks

1. Save what you found, with where and when you found it. Get the original file if you can, not just a screenshot.
2. Run it through Detect and note the result and the confidence score.
3. Match the code to your private list and pull the delivery records for that copy.
4. Talk to the person calmly. Ask how the file was shared on their side. Many leaks turn out to be careless forwarding.
5. Don't accuse anyone publicly based only on a match.
6. Get legal advice before any formal step, such as a termination, a claim under an NDA, or a takedown request.
7. Tighten what you send next time: fewer recipients, sensitive parts sent separately, shorter-lived links.

Where this approach has limits

• It doesn't prevent leaks. It makes marked copies traceable, nothing more.
• It identifies a copy, not a person.
• Retyped or paraphrased content isn't traced, and neither is something recreated from scratch.
• A photo of a screen is harder than a screenshot, because it degrades the image more.
• Whether it counts as evidence depends on where you are and what the process is. That's a question for a lawyer, not for a tool.
• Deleting the record ends detection. There is no separate control that stops detection while the file stays active.

FAQ

Can I prove who leaked a file if I sent everyone the same copy? Usually not from the file itself. Without something unique in each copy, every recipient looks the same. Delivery logs may still help narrow it down.

Is a watermark match enough to fire someone or sue? On its own, it shouldn't be treated that way. It shows which copy leaked, not who shared it or why. Talk to a lawyer before any formal step.

Does it work on screenshots? Often, within limits: the mark is designed to survive screenshots, but heavy edits, small crops and strong compression can destroy it. Roughly 256 px of a detailed area is the approximate minimum. For PDFs, upload the PDF itself when possible. A PDF screenshot is best effort and is not guaranteed.

Can I trace a file I sent before I started marking? No. Only copies marked before they were sent can be traced.

Start before the next file goes out

Pick the files that would hurt most if they leaked, give each recipient their own marked copy in Markedfile, and keep the list private. File contents are processed in memory and are not stored. Related reading: how to trace a leaked PDF and what forensic watermarking is.