Free PDF Forensics Tool

Read every save the file remembers

A PDF writer that saves changes to an existing document appends them. The new and changed objects go at the end of the file with a new cross reference section and a trailer that points back to the previous one, and the original bytes stay where they were. That is the incremental update mechanism the format has carried since PDF 1.1, and it means a file can hold its own history: the original save, every save after it, the objects each save rewrote and the generation number each object had reached. The check walks that chain from the final startxref back to the first, reads cross reference tables and cross reference streams alike, matches each section to the end of file marker that closed it, and lays the saves out on a byte map.

A single save is the ordinary case for a document exported once. Several saves tell you that the file was opened and changed after it was first written, and the table names the objects each save touched, which is where to look for what changed. A file that was saved as a fresh copy carries no history at all, so one save is not a finding that nothing changed; it is a reason to ask the custodian for the earlier copies.

Follow the producer and creator chain

Every save that rewrote the Info dictionary left a version of it behind, and the check reads each one where it lies in the file, so you see the creator, the producer, the creation date and the modification date as they stood after each save. The XMP packet carries its own copies of those values and often an edit history with the software agent and time of each action. When the Info dictionary and the XMP packet agree, one writer kept them in step. When the producer or the dates differ, a second application handled the file and updated one record and not the other, which is ordinary for a conversion and significant when a party says the file is an untouched original.

The trailer carries a pair of file identifiers; conforming writers keep the first fixed for the life of the document and change the second at every save, so a pair that still matches has not been through such a save, and a pair that differs has. All of these are statements the writing software made about itself. The check reports them as recorded, side by side, and leaves the question of which account to believe to the examiner.

See what each signature covers

A digital signature in a PDF signs a byte range, not the whole file. The signature dictionary records the range in four numbers, and a conforming signer covers everything in the file at the moment of signing except the signature value itself. The check reads each signature field, its byte range and the revision that range reaches, and draws the range on the byte map. A signature that reaches the end of the file covers the final revision. A signature that stops at an earlier end of file marker covers the document as it stood then, and everything appended after it was added without that signer.

Appending after a signature is lawful under the format, which is how a second party countersigns and how a form is filled after certification, and the document modification detection and prevention settings say what the signer permitted. The check reports the signer name, reason, location and signing time as the dictionary records them, the subfilter that names the signature format, and the coverage. Version 1.0.0 does not validate certificates, does not verify the cryptographic signature value against the covered bytes and does not check revocation or trust; it says so in every report, and a validated check is part of a full examination.

Find the scripts, actions and attachments

A PDF can carry programs and payloads. Document level JavaScript sits in a named tree in the catalog, an OpenAction runs when the document opens, additional actions run on page events, form field events and annotation events, a Launch action starts an external program, a URI action opens an address, a SubmitForm action sends form data somewhere, and embedded files travel in a second named tree or in file attachment annotations. The check lists every action it finds with its type, where it is attached and the first part of its script or target, and every embedded file with its name, declared size, type, dates and checksum, and computes the SHA 256 of the decoded attachment so it can be identified without opening it.

None of this is a finding that the document is malicious. Scripts validate forms and attachments carry exhibits every day. It is an inventory counsel should have before a document is opened on a workstation that matters, and before it is produced to the other side with contents nobody looked at.

Read the fonts and images

Fonts and images say what produced a page. The check lists every font with its subtype, base name, encoding, whether its program is embedded and whether the embedded program is a subset, and every image with its dimensions, bits per component, color space, compression filters and declared length, each mapped to the pages that use it. A document that claims to be a scan but carries subset embedded text fonts, a page set in one font family with one line in another, a run of images compressed with one filter and one image with a different filter, or a font without an embedded program in a file that was supposed to render identically everywhere is each a question to put to the custodian. The report records the inventory; it does not rank fonts or images as suspicious.

Check what remains under the redaction boxes

A redaction that is done properly removes the text from the content stream and draws the box in its place. A redaction that only draws a black rectangle over the text leaves the text in the file, where a copy and paste, a search or a parser recovers it in seconds. The check parses the content of each page in drawing order, tracks the graphics state through transforms and saved states, positions every text run from the font metrics the file supplies, records every filled shape with its color, and then asks which text runs were painted before a shape that covers them. For each covered run it reports the page, the position, the fill color class, the fraction covered and the text that remains, decoded through the font's ToUnicode map when the file supplies one and otherwise through its encoding.

Redaction annotations that were never applied, text drawn in the invisible render mode and images placed over earlier text are each reported in their own words, because a scanned page with an invisible text layer is a legitimate document and an unapplied redaction annotation is a document about to be produced with its secret intact. The render pdf.js produces shows each flagged region outlined on the page. When a document is bound for production, the next step is a forensic examination of the production set, and the check tells you which pages to start with.

Your files and reports remain local

The selected PDF, file names, hashes, decoded text, attachments, notes and report data never reach a server. Optional usage measurement stays off unless you allow Analytics. With permission it sends GDF only the tool name and fixed action labels, such as analysis completed or report prepared, never an input, result, filename or visitor identifier. Google and advertising scripts do not load on this page. Use Cookie settings below to change your choice. Program files, the parser and fonts download from this website; nothing about your document travels with them.

Clear cancels active work and removes the displayed records without deleting your original or any report you saved. Saved reports can contain private file names, hashes, recovered text and notes; review them before sharing.

Save the report

Download the PDF or HTML report in the Global Digital Forensics four section layout: the executive triage and file identity with the full SHA 256, the plain English interpretation guide, the structured findings inventory with every observation located by save, object and page and your notes, and the evidentiary scope advisory with the beta notice. The Excel ready CSV gives one column per field and the JSON is the lossless record of the revision chain, every object listed by every save, the Info dictionary at each save, the XMP values, each signature and its byte range, every action, attachment, font and image, each page's covered text runs and the coverage of every parser stage. The PDF and HTML reports carry the byte map and reduced renders of the flagged pages as figures; no report contains the document itself.

Formats and resource requirements

Each file is limited to 64 MiB, 250,000 objects, 256 cross reference sections and 2,000 pages. Each decoded stream is limited to 16 MiB, the redaction check covers the first 60 pages and 20,000 text runs per page, and pdf.js renders at most 8 flagged pages for the report figures. The operation time limit is 120 seconds. Limits stop a stage with an explanation and record the coverage reached rather than returning a shortened result as if it were complete.

Coverage is recorded, not assumed

Every result states what it examined. The save history records whether the cross reference chain was walked to its start and how many objects the byte scan found that no section lists, the object inventory records how many objects were parsed and how many failed, the redaction check records the pages and text runs it covered and the fonts whose widths or encodings it had to approximate, and the signature layer records that no cryptographic validation was performed. Detection accuracy on real world documents has not been measured by GDF, so an unavailable, cancelled or quiet result is unknown rather than a finding that the document was not changed.

Keep the original and its collection context, work on copies, and bring the observations that matter to a case to an examiner who can test them against the custodian's systems. Tell us about a problem with the tool; the link attaches no selected file or report.

Related tools and methods

Metadata Analyzer reads the properties of PDFs and many other file types through ExifTool, Metadata Comparison places two or more copies of a document side by side, and the Surveillance Video Tamper Check applies the same layered method to exported footage; reselect your file there, because inputs are never placed in links. When a matter turns on a document, expert witness services begin with a full examination, and eDiscovery production engagements carry the production set from preservation through review.

Versions and methods

The structure parser follows the file structure, cross reference, object stream, signature and action chapters of ISO 32000-1, PDF 1.7, and ISO 32000-2, PDF 2.0, and the XMP reading follows the XMP specification. Page rendering and text reading use pdf.js 6.4.299, served from this website under the Apache License 2.0. These references describe the methods; they do not certify this tool. Version 1.0.0 beta. All free tools.