From a leaked copy to an answer.
How to trace a leaked file with forensic watermarking: what to decide before you send, what to do in the first hour, and what a match can prove.
- Etchv
Which copy
Etchv reads the watermark in the file you found.
- Your records
Which delivery
You look the watermark up in your records: what was sent, to whom, and when.
- Your team
Who shared it
No watermark can answer this. Your investigation does.
Three leaks. Three lessons.
All three are public record. Each trace led to one copy or one account.
- 2004
Academy screeners
Seven films appeared online. A watermark on each identified the Academy member whose tapes they were. He admitted sending his screeners to a man in Illinois, who digitized them and pleaded guilty to copyright infringement.
The mark found the copies. An admission did the rest.
- 2015
The Hateful Eight
A watermark led to a screener addressed to a film executive. An assistant had signed for it. “I’ve never seen this DVD,” the executive said.
The named recipient may never have handled the copy.
- 2022
Vardy v Rooney
Posts shown to a single Instagram account reached a newspaper. The High Court found that a second regular user of the account had probably passed a post on, with the owner’s knowledge and approval.
The court asked who used the account, not whose it was.
What closes the gap
- Access and download logs
- Delivery signatures
- Who else uses the account or mailbox
- Timing against the delivery
- Device and print records
Four decisions before the first copy.
What a reference stands for
It sets what a match can tell you. One per recipient tells you who. One per send tells you which send. One per draft tells you which version: a new draft sent with an old reference gets the old watermark.
Who holds the lookup
Keep the list that links watermarks to recipients with someone who will not run the investigation or decide its outcome.
What recipients are told
Say that every copy is individually marked. We know of no controlled study showing that such notices reduce leaks. Tell people because it is fair, and because your counsel may say you must.
How long a delivery stays investigable
Etchv matches a damaged read to the nearest watermark among your assets. Delete an asset and that stops for its watermark. A PDF stays readable after you delete it: the tokens that resolve its pages are kept permanently.
What a distribution costs and takes.
Every recipient’s copy is its own job. Your plan sets how many run at once.
960 credits
Within one month of Growth (1,000 credits).
| Sent | Plans | No more than about |
|---|---|---|
| One at a time | Growth, Scale, Business | 20 minutes |
| 4 at a time | Scale, Business | 9 minutes |
| 16 at a time | Business | 5 minutes |
Timed with the 8-page PDF in the benchmarks of September 29, 2026: the median of 5 runs at each level, standard processing. Shorter PDFs finish sooner. A rough guide, not a commitment.
Plans and creditsLonger than 8 pages. Split the document into parts and give every part the same reference. All the parts then carry the same watermark. A leaked file longer than 8 pages must be split again before it can be read.
A copy has surfaced. The first hour.
The first two steps can’t be redone later.
Keep the file exactly as you found it.
Don’t re-save, crop or convert it. Note where it was, when, and who found it.
Hash it and start a custody log.
If this could reach a tribunal or a court, record everyone who handles the file from now on.
Read the watermark from a working copy.
The dashboard does it without code.
Save the result yourself.
It is not added to your asset library.
Find the delivery.
In your own records, or by searching your Etchv assets for the watermark, in the dashboard or through the API.
Bring in legal before you name anyone.
Then give the match and the custody log to whoever investigates.
Two results that are easy to misread.
A watermark you never created
Etchv returns what it read and doesn’t say whether that watermark is yours. A badly damaged copy can read as a watermark that matches nothing.
Treat it as no match, not as someone else’s file. Try the least-processed version you can find.
Two watermarks in one file
The overall result says not watermarked, and the pages or frames return different watermarks. Someone may have combined two recipients’ copies.
Look up each one. You now have two deliveries to examine.
What the mark survived. And what is untested.
Measured: 98 PDF pages
- Shrunk to half size, then enlarged again94 of 98
- Saved as a JPEG at quality 7588 of 98
- 5% trimmed from every edge, then enlarged again80 of 98
Pages that returned their exact watermark after one digital change to the page image at 144 dpi. Of 109 pages tried, 2 could not be watermarked and 98 made the comparison. September 2026, on a pre-release build with the model now in production. A small sample, not a guarantee.
Not measured yet
- Prints and scans
- A phone photo of a screen
- Recompression by chat apps and email
- Deliberate removal with a PDF editor
- Video, under any change
Out of reach
- Text copied out of a PDF
- Retyped or summarized text
- A redrawn chart or table
The watermark is in the page image. Text that is copied out or rewritten carries none of it.
Plan it before
you need it.
Walk through your distribution, your records and your first hour with the people who build Etchv.
7 days · 200 credits · No card required