Showing posts tagged “pdf”.
Six practical checks — from metadata dates to hidden revision history — that reveal whether a PDF was modified after it was created, and what each one can and can't prove.
Only one of these detects a change to a document. What each standard actually asserts, where signatures stop covering the file, and why a missing set of content credentials proves nothing at all.
Fifty-plus terms from PDF structure, image forensics and the signature world, defined for the person reading a forensic report rather than writing one — including what each one does not mean.
Documents carry more clocks than people expect — and fraud usually breaks at least one. Where timestamps live, which ones lie easily, and how to read them together.
ExifTool, pdfid, qpdf, mutool, FotoForensics and the rest — what you can genuinely establish about a suspicious document with software that costs nothing, in what order, and the four things free tooling cannot do.
Every document has a typographic fingerprint — and edits break it. How font substitution, spacing drift, and impossible typefaces expose altered and backdated documents.
Change a PDF and save it, and most software leaves the old version physically inside the new one. Sometimes the amount before the edit is still sitting there, waiting to be read.
Drawing a black box over text does not remove the text. The difference between redaction and the appearance of redaction — and a workflow to make sure you're doing the first one.
Two copies of "the same" agreement, one clause different. How to prove which version is real — from signature validation to word-level diffs and the PDF's own history.
Every PDF carries two hidden records about where it came from. Here's how to read the Info dictionary and the XMP packet, what each field means, and the disagreement that exposes tampering.