The 30-Second Document Check Anyone Can Do
Most documents don't need a forensic exam — but almost all deserve 30 seconds of honest attention. The three-part habit that stops you from ever saying 'it looked fine.'
Showing posts tagged “forensics”.
Six practical checks — from metadata dates to hidden revision history — that reveal whether a PDF was modified after it was created, and what each one can and can't prove.
Most documents don't need a forensic exam — but almost all deserve 30 seconds of honest attention. The three-part habit that stops you from ever saying 'it looked fine.'
Screenshots became the default 'proof' people submit — and they're the easiest forgery there is. Why a picture of a screen should count for so little, and how fakes give themselves away.
Every PDF carries two hidden records about where it came from. Here's how to read the Info dictionary and the XMP packet, what each field means, and the disagreement that exposes tampering.
'Document fraud' means something different in freight, lending, insurance, and HR. Where the risk concentrates by industry — and why the forgery technique should decide your defense.
Document forensics is the discipline of reading the evidence documents carry about themselves. Here's what it examines, how the layers fit together, and what it can and cannot prove.
ELA is the most famous technique in image forensics and probably the most misused. What it actually measures, what a hot spot really means, and how professionals keep it honest.
A photo carries a hidden layer of data — when, where, and with what it was taken. How EXIF corroborates a claim or contradicts it, and why missing metadata isn't a verdict.
Image models can now render a passable receipt in seconds. What that actually changes about document fraud — and which defenses barely notice.
Edges, lighting, metadata, reverse search, and error level analysis: a working sequence for checking whether an image has been edited — and knowing when you need tooling.
Cloning a region of the same image is the forger's favorite move — the borrowed pixels come pre-matched. How copy-move detection works, and where it shows up in documents.
OCR tells you what a document says. It has nothing to say about whether it's real. Why extracting a document isn't verifying it — and why you need both, in order.
Two copies of "the same" agreement, one clause different. How to prove which version is real — from signature validation to word-level diffs and the PDF's own history.