Pages forensics

Apple Pages forensics

Apple Pages (.pages) is the iWork word processor. The format is a bundle: directly on macOS it's a folder containing plist metadata and content streams; in submission contexts it's usually delivered as a ZIP archive of that bundle structure.

iWork Pages is common for Mac-using students, especially those who don't have a Microsoft 365 subscription.

Signals available on Pages

• plist metadata — Pages stores authorship metadata in a property-list (Pages-DataList, Pages.zip bundle plist) rather than the OOXML XML form. Autotend Forensics reads the binary plist directly.
• Authorship fields — Author, Created date, Modified date, Last opened by, the originating Pages version, and the macOS username at creation time.
• Edit history — Pages records "change tracking" similar to Word's tracked changes when the feature is enabled.
• Paste detection — formatting-run inventory.
• Linguistic signals — every AI-assisted-writing detector runs against the body text after we extract from the bundle.
• Export trail — Pages files that have been exported to DOCX-and-back carry an export-trail signature.

Common false-positive paths

• Pages → DOCX export → submission is one of the most common iWork patterns. The DOCX claims Application = "Microsoft Word" but the structural fingerprint shows it passed through Pages. That's not academic dishonesty; that's just an iWork user submitting DOCX as the assignment requested.
• iCloud-collaborated Pages files carry a different metadata pattern from local-only files. If the class uses iCloud-shared documents, expect this.
• Pages 14+ (recent versions) added new metadata fields that some older detectors don't recognize. Autotend Forensics calibrates against current versions; older third-party tools may not.

What's distinctive about Pages review

The Pages bundle structure carries macOS user identity beyond just the Author name — the binary plist includes the account UUID, which is harder to fake than the application-level Author field. For high-stakes review this can be valuable.

If the student submitted a .pages file directly (not converted to DOCX or PDF), you get richer authorship information than the equivalent DOCX. Encourage submission of native iWork files when possible.

What to expect

A typical authored Pages scan surfaces:

• Full bundle inventory.
• plist metadata flattened to readable fields.
• The originating macOS user identifier (account UUID).
• Linguistic signals on the body text.
• Cross-format export history if the file has been round-tripped.

Pages files are an under-served format in most plagiarism / academic-integrity tools; Autotend Forensics treats them as a first-class submission type.