Updated 2 August 2026
A PDF is not a flat image: it is a documented format that retains far more about its own history than the visible page suggests. Here is what it keeps, and what can be inferred from it.
When software saves a change it can rewrite the whole file, or append the changed objects to the end and leave everything before untouched. The second mode — the incremental update — is the default in several editors, and it is a gift for analysis: every revision is a preserved snapshot.
A file with three revisions was saved three times. Truncate it at the end of the first to recover the original state, then compare.
Deleting an element in a PDF editor removes it from the display, not necessarily from the file. The object becomes orphaned: no longer referenced, still present. Finding an old amount, an old address or a logo that no longer appears is strong evidence.
A PDF can carry metadata in two places: the legacy Info dictionary, and an XMP stream in XML. Many tools update one and forget the other.
A divergence between them — different dates, different producers — reveals processing by a tool that did not clean up after itself. XMP sometimes keeps a DocumentID and a version history more talkative than the Producer field.
Metadata fields are free text: anyone can write whatever producer they like. A well-informed forger restores the expected value after editing.
This is why structural evidence matters more: object ordering, compression style, how the cross-reference table is written. Those details are emitted by the library that wrote the file, and a forger does not reproduce them by editing a string. A file announcing one producer while its structure matches another is an interesting case.
This deserves saying plainly: most modified PDFs were modified for entirely mundane reasons — compression before sending, adding a signature, merging documents, flattening a form, passing through an archiving tool.
Detecting a modification therefore only moves the question along: what was modified, and does it touch data that matters? Several signals converging on the same region of the document make a case; one signal on its own does not.
Analyse a document for free