PDF forensics: what a file reveals about itself
A PDF is not just a picture of a document. It is a small database with history, timestamps and fingerprints from every program that touched it. Here is what can be read from it, and what it means.
Updated 2026-08-31 · Veriflied
What is inside a PDF
Behind what you see on screen, a PDF contains metadata about who or what created it (Producer and Creator), when it was created and modified, a document id, often an XMP packet with editing history, fonts carrying information about the tool that embedded them, and a structure that shows whether the file was made in a single pass or saved several times.
None of it is visible when reading the document. All of it can be read by a program. That is PDF forensics: using the file's own information to assess whether the document is what it claims to be.
The most important traces
The producer chain
Which program made the file? Billing systems, public portals and hospital systems write their own name. Generic PDF libraries, browsers and word processors do not. A retailer's 'invoice' made with ReportLab is not from the retailer.
Timestamps
Creation and modification times in both the classic info block and the XMP packet. They must agree with each other, with the file's history and with the date the document claims to carry.
Revisions
A PDF can be saved incrementally. Then the earlier version still sits inside the file. The number of revisions, what changed between them and whether the tool changed along the way are among the strongest traces.
Editing history
The XMP packet often lists actions: created, converted, saved, edited. 'Edited' on a system-issued document is a finding in itself.
Document id
PDFs carry an id pair: one from creation, one from the latest save. If they differ, the file was saved again after creation. If the id is missing entirely, the file usually did not come from a professional system.
Fonts
Embedded fonts carry a generation tag. Several generations in the same file mean text was added in several rounds, often by different tools.
Reading the traces together
One trace alone rarely proves anything. A file can be saved twice for an honest reason. The strength is in the combination. An invoice made by a generic library, created and modified in the same second, without an XMP packet, without a document id and created two days before the claim, is not four small findings. It is one pattern, and its name is 'freshly generated document without issuer identity'.
A forensic analysis therefore works with named patterns on top of the individual traces and explains why the pattern is a concern. That is what an investigator or an accountant can act on.
What PDF forensics cannot do
It cannot tell whether the content is true. A perfectly genuine invoice can cover a lie. And a file printed to paper and scanned again has lost its history. Then the analysis moves to the image: scanner chain, compression and AI detection. That is why document and image forensics belong in the same tool.
Frequently asked questions
Can't metadata simply be changed?
The visible fields can. But they must be changed consistently across the info block, XMP packet, revisions, fonts and document id, and most forgers do not know half of these exist. Inconsistencies between the layers are a finding in themselves.
What is the difference between Producer and Creator?
Creator is the program the document was written in (for example Word). Producer is what made the PDF file (for example Acrobat or a printer driver). The combination says a lot about how the file came to be.
Can the original version be recovered from an edited PDF?
When the file was saved incrementally, yes. The earlier version sits physically inside the file and can be extracted and compared with the latest.
Which document types is this relevant for?
Anything issued by a system and used as evidence: invoices, receipts, bank statements, medical certificates, record printouts, police reports, appraisals and attestations.
Try it on your own document
Create an account and analyse your first 10 images or documents for free. You get a report with the concrete findings, not just a score. All processing in the EU.