How to Check if PDF was Altered or Edited? Learn

1. Check PDF Document Properties and Metadata

You can check if PDF was altered in Adobe Acrobat by checking the PDF metadata. Metadata contains in-depth information about the creation, modification, author, and editing software for a PDF.

To check the metadata to track all PDF edits & versions:

1. Open the PDF in Adobe Acrobat Reader.
   
2. Press Ctrl + D (Windows) or Cmd + D (Mac) to bring up the Document Properties window.
   
3. Check the Description tab for fields including Created and Modified Date, and Application to check PDF edit history:
   
   • Crafted Date shows when the PDF file was created.
   • Modified Date shows when the PDF file was edited (with this, you can easily check when a PDF was modified).
   • And the Application field shows which application was used to create or edit the PDF file.

Moreover, you can also check the “Advanced section” to find out which software was used to produce the PDF file. If the PDF producer is different from the original PDF metadata, then you can be sure that your PDF file was altered.

Expert insight:

In our lab testing, we observed that altered PDFs often contain words like “PDF Converter,” or “Online PDF Tool”, etc, in the “Application” metadata field, which is an indication that the PDF file has been edited and then exported or regenerated.

2. Compare File Size and Structure to Check if PDF was Altered

Even a minor change like deleting text, inserting a picture, or altering a signature can just create changes to the internal structure of your PDF and its size. By comparing the file structure, you can check if PDF was edited or not.

How to Examine the File Structure:

1. Find both the suspicious PDF and the original file if you have it.
2. You want to look at the two file sizes, if there are noticeable differences (larger or smaller) usually indicates some compression, addition, or removal.
3. You can also open the suspicious PDFs in a text-based hex viewer where you can see embedded fonts, images or annotations to check if PDF was altered.

Professional Note:

In forensic analysis of a PDF, different PDFs usually show altered XREF tables or newly embedded objects when compared to the original. These are great, but subtle changes that reveal the PDF document has been created again.This way you can check if PDF was edited.

3. Use the “Compare Documents” Feature in Acrobat

If you have the PDF file, the easiest way to check if PDF was altered in Adobe Acrobat is to compare the two versions.

How to Compare:

1. Launch PDF Comparison tool like Adobe Acrobat Pro.
2. Click on the View drop-down tab, then “Select Compare Files”.
3. Upload the original PDF into one of the fields and the PDF you suspect has changed into the other.
4. Acrobat will automatically highlight changes in the text, formatting, fonts, colors, and layout, which are delivered to you side by side.

Why this works:

The comparison will highlight the specific sections that have changed in your PDF file.

4. Inspect Fonts, Images, and Embedded Objects

PDF files keep all fonts, images, and objects that were used. Modifications of PDF files to any of these can be powerful indicators of potential alteration.

Manual check if PDF was edited:

1. Open the PDF in your browser, locate the File option, click on Properties, and then select the Fonts section located at the top to check if PDF was altered.
2. See the fonts listed; if you see any new font names that were not in the original, it is a good indication that there have been edits to the document.
3. You will also want to check for newly inserted images or images removed using the same process either by scanning the document visually, or using a PDF content inspector to check if PDF was modified.

Many PDFs that have been edited will include secondary font encodings or compressed image formats that would not normally be found on a real PDF. Determining any differences like this can help investigators to check if PDF was altered.

5. Check for Digital Signatures and Validation

Digitally signed PDFs include cryptographic hashes that secure integrity. If a file has been changed after it has been signed, it will appear to have an invalid signature.

To Verify:

1. Open the PDF in Acrobat and see if there is a Signature Panel on the right-hand side of the document.
2. If it says Signature Invalid or Document has been modified since signing, then the document has been modified.

Why It Matters:

Digital signature validation is the gold standard in forensic validation. It provides a verification of authentication instantly without having to compare files to check if PDF was edited or not.