How to tell whether a PDF has been modified

Updated 2 August 2026

A PDF is not a flat image: it is a documented format that retains far more about its own history than the visible page suggests. Here is what it keeps, and what can be inferred from it.

Contents

  1. Incremental revisions
  2. Ghost objects
  3. The two sets of metadata
  4. What metadata does not prove
  5. Modified is not the same as fraudulent

Incremental revisions

When software saves a change it can rewrite the whole file, or append the changed objects to the end and leave everything before untouched. The second mode — the incremental update — is the default in several editors, and it is a gift for analysis: every revision is a preserved snapshot.

A file with three revisions was saved three times. Truncate it at the end of the first to recover the original state, then compare.

Ghost objects

Deleting an element in a PDF editor removes it from the display, not necessarily from the file. The object becomes orphaned: no longer referenced, still present. Finding an old amount, an old address or a logo that no longer appears is strong evidence.

The two sets of metadata

A PDF can carry metadata in two places: the legacy Info dictionary, and an XMP stream in XML. Many tools update one and forget the other.

A divergence between them — different dates, different producers — reveals processing by a tool that did not clean up after itself. XMP sometimes keeps a DocumentID and a version history more talkative than the Producer field.

What metadata does not prove

Metadata fields are free text: anyone can write whatever producer they like. A well-informed forger restores the expected value after editing.

This is why structural evidence matters more: object ordering, compression style, how the cross-reference table is written. Those details are emitted by the library that wrote the file, and a forger does not reproduce them by editing a string. A file announcing one producer while its structure matches another is an interesting case.

Modified is not the same as fraudulent

This deserves saying plainly: most modified PDFs were modified for entirely mundane reasons — compression before sending, adding a signature, merging documents, flattening a form, passing through an archiving tool.

Detecting a modification therefore only moves the question along: what was modified, and does it touch data that matters? Several signals converging on the same region of the document make a case; one signal on its own does not.

Analyse a document for free