Document Forensics & Tamper Inspection
Inspect PDF contracts, invoices, and resumes directly in your browser. Find out if dates were altered, if bank account details were edited after export, or if invisible text layers were injected — without uploading sensitive files to external servers.
Scans document dictionary, compiler metadata, and revision increments in browser memory. Supports PDF 1.0 to 2.0 up to 30 MB.
Document Forensics Pipeline
A 4-stage structural audit of document containers, creation toolchains, and post-export revision layers:
Verifies that the document conforms to standard PDF specifications and hasn't been corrupted by file renaming or automated scraping tools.
Identifies whether the file was authored in Microsoft Word, Adobe Acrobat, InDesign, or compiled via automated programmatic scripts.
Checks if numbers, dates, or payment details were modified after initial export by scanning for appended revision blocks and trailer updates.
Detects invisible white-on-white text layers designed to trick ATS resume screeners, zero-opacity vector masks, or embedded scripts.
When validating sensitive enterprise files (such as vendor invoices, employee resumes, and signed contracts), cross-reference these six structural checks against expected baselines:
Examines declared Producer and Creator strings against standard word processing suites.
Validates ASN.1 timestamp synchronization between CreationDate and ModDate fields.
Scans the raw byte stream for multiple %%EOF markers and xref trailer updates.
Audits embedded PostScript and TrueType font descriptors and glyph widths.
Probes content streams for zero-opacity vector planes and clipping path anomalies.
Checks for valid X.509 certificate chains or embedded C2PA Content Credentials.
Understanding common PDF deception patterns helps compliance teams and forensic examiners spot fraudulent submissions early:
Attackers intercept legitimate corporate invoices and edit the beneficiary banking details in Acrobat. Because Acrobat appends updates incrementally, the original bank details remain intact before the first %%EOF marker, while the second trailer points to altered text objects.
Candidates inject invisible 1-point white text containing hundreds of technical buzzwords behind visible resume lines. Applicant Tracking Systems (ATS) index the hidden text, granting artificial ranking boosts while human HR reviewers see none of the text.
To sanitize digital footprints, fraudsters re-render suspicious files through virtual PDF printers (such as Cairo or Skia). This flattens vector layers and wipes original author metadata, but leaves distinct compiler signatures that immediately distinguish the file from native office exports.
No. PDF metadata provides critical structural clues — such as the software used to compile the file and whether incremental updates occurred — but metadata can be spoofed or stripped. Genuine documents should be corroborated with visual analysis and digital signatures.
Many web applications, privacy-enhancing PDF compressors, and scanning hardware automatically sanitize metadata during export to reduce file size or eliminate personally identifiable information.
When a PDF is digitally signed, annotated, or modified in Adobe Acrobat without a full rewrite, the updates are appended to the end of the file following a new %%EOF marker. This can indicate legitimate digital signing or unauthorized post-facto redactions.
Common techniques include compiling synthetic text and AI-generated portraits into a Word document and exporting to PDF, using invisible font layers behind scanned raster images, or re-rendering PDFs through virtual printers to wipe provenance trails.
