New information extracted from Snowden PDFs through metadata version analysis

Can someone spell out how this is possible? Do pdfs store a complete document version history? Do they store diffs in the metadata? Does this happen each time the document is edited?

PDFs are just a table of objects and tree of references to those objects; probably, prior versions of the document were expressed in objects with no references or something like that.

You can replace objects in PDF documents. A PDF is mostly just a bunch of objects of different types so the readers know what to do with them. Each object has a numbered ID. I recommend mutool for decompressing the PDF so you can read it in a text editor:

    mutool clean -d in.pdf out.pdf

If you look below you can see a Pages list (1 0 obj) that references (2 0 R) a Page (2 0 obj).

    1 0 obj
    >
    endobj

    2 0 obj
    >
    endobj

Rather than editing the PDFs in place, it's possible to update these objects to overwrite them by appending a new "generation" of an object. Notice the 0 has been incremented to a 1 here. This allows leaving the original PDF intact while making edits.

    1 1 obj
    >
    endobj

You can have anything inside a PDF that you want really and it could be orphaned so a PDF reader never picks up on it. There's nothing to say an object needs to be referenced (oh, there's a "trailer" at the end of the PDF that says where the Root node is, so they know where to start).

I have read claims that there were fake documents inserted in those leaks, who aimed at pushing disinformation.

This is insightful work, great job.

Recently someone else revisited the Snowden documents and also found more info, but I can't recall the exact details.

Snowden and the archives were absolute gifts to us all. It's a shame he didn't release everything in full though.