The information dictionary
Every PDF has a small structure holding Author, Title, Subject, Keywords, Creator and Producer, plus creation and modification timestamps. The author field is usually filled in automatically from the account name on the machine that made it. Nobody sets it deliberately, and almost nobody checks it.
Incremental saves keep the past
PDFs can be updated by appending changes to the end of the file rather than rewriting it. The original content stays where it was. A file saved this way several times contains its own earlier versions, and text that was edited out can often be recovered from it. You can spot this: the marker that ends a PDF appears more than once.
Redaction boxes that are only boxes
Drawing a black rectangle over text in a PDF viewer adds a rectangle. It does not delete the text underneath, which stays selectable and copyable. This has produced real disclosures in court filings and published government reports. True redaction removes the content and then flattens the document.
What else can be hiding in there
PDFs can carry embedded JavaScript, attached files, actions that ask to launch a program, and reviewer comments left in as annotations. This page reports all of them.