How to check if PDF was edited or not.

[Tech-nol]

We need program to check if PDF was edited or not. For example bank statement. Is it original or edited. Do you have program for this? Maybe Adobe Pro? We need to check not our document, but clients bank statement to be sure that income is real and PDF is not edited with fake income. So maybe you have or know program which can do this?

[AnandSri · Accepted solution]

Hi!

I hope you are doing well.

There is no sure proof way to determine if a generic PDF file is modified. If you go to the document properties of a PDF file (control or command d), if the proper metadata is available, it will list the creation date and time and modified date and time.

This can help you determine if a pdf file has been modified since creation. However, it is not foolproof. This metadata is not secured.

The easiest way to detect if a file has been modified to digitally sign the document. Reader and Acrobat will report if the document has been changed since it was signed.

For detailed information about the signature, please see this article: https://helpx.adobe.com/acrobat/using/certificate-based-signatures.html 

I hope this helps.

Thanks,
Anand Sri.

[AnandSri · Accepted solution]

Hi!

I hope you are doing well.

There is no sure proof way to determine if a generic PDF file is modified. If you go to the document properties of a PDF file (control or command d), if the proper metadata is available, it will list the creation date and time and modified date and time.

This can help you determine if a pdf file has been modified since creation. However, it is not foolproof. This metadata is not secured.

The easiest way to detect if a file has been modified to digitally sign the document. Reader and Acrobat will report if the document has been changed since it was signed.

For detailed information about the signature, please see this article: https://helpx.adobe.com/acrobat/using/certificate-based-signatures.html 

I hope this helps.

Thanks,
Anand Sri.

[Bevi Chagnon - PubCom.com · Accepted solution]

Wow.

Forensic accounting. Interesting question. You suspect your client is cheating with digital forgeries!

Adding to Anand's reply above, one thing to note: you will see a modified date in the metadata (File / Properties / Description tab) not just because the content was edited (such as adding $10,000 to the bank balance), but also if any highlighting or comments were added to the file.

Example: in my bank statements, I add comments to them to flag major purchases or items that have been reconciled with our accounting system. My comments would trigger that the file was modified, yet no content had been edited.

Since the content of PDFs can be edited, it's difficult for a program to track what WAS there and what IS there now. I don't know of any tools that can track or identify where the content has changed, but if you knew someone with PDF coding experience, they might be able to spot some digital paper trails in the source code of the file itself. (Maybe one of our braniac PDF coders on this forum will chime in on this.)

If you could get ahold of the bank's original version (such as redownload a fresh copy of the PDF, or via warrant request PDFs from the bank itself), you could then use Acrobat Pro's Compare utility. Select both PDFs, click the button, and it compares the differences between the 2 documents, including formatting and edited content. But this works only if you have the original PDF.

[andy5CC7]

Hi, 

I have a relatively easy solution to this. 
I work for a cryptocurrency company as a compliance agent. I figured out that if you were to open the pdf document with notepad. You will be able to see the metadata. 80% of the time I was able to see if client has used photoshop or illustrator to edit the file or not. Hope this helps buddy.

Best regards, 

Andy L

[andy5CC7]

If anyone can figure out how to crack or understand the Chinese japanese Korean metadata please let me know. That would be super helpful!

[Test Screen Name]

The PDF specification, ISO 32000, includes full details on metadata and string formats. It is public info, no need to crack anything or guess.

[andy5CC7]

Hey, was talking about something like this

It's hard to determine whether it was edited or not. Sometimes pdf doesn't detect everything

[ZBalling]

Of course, he meant Notepad ++.

[harmony234114746z9i]

I tried it but it showing different symbols which is unreadable. Are you able to help with this please

[Prashant362110930rvd]

Hi, you said a pdf can be tracked easily if any user try to edit that pdf using any tools ? but i am not sure how it would be because based on only modified time how it would be possible to track it. Could you please explain it with having some example to understand more.  
Also look at the file i attached and let me know what you find. 
Thanks . 

[Prashant362110930rvd]

Hi, can you please let me know how a invoice can be tracked ? if i wanna know that invoice is real not fake then what would be best way to find out without having much issues or problems. 

[JR Boulay]

It's very simple: each PDF document has a unique identifier number, the "Permanent identifier", made up of two parts.

It is therefore sufficient to compare the "Permanent identifier" of the original document with another document to know if this one has been modified.

abracadabra-DocID is a free plugin for Acrobat which allows you to easily compare "Permanent identifier": https://www.abracadabrapdf.net/?p=964

[Test Screen Name]

I think there is a very important point to make about this, because people are saying what is supposed to happen, and it's all true. BUT, it's useless from a Forensic point of view. The rules of PDF are not a secret, or even difficult, so anyone who is motivated can fake anything. 

So these answers are useful from the point of view of "I wonder if anyone in the department edited this, and when, so I can know if my copy is out of date". However they are all useless from the point of view of "I have this contract and I think someone has edited it". Useless, useless. This would never stand in court. 

This is why digital signatures were invented. 

[JR Boulay]

"anyone who is motivated can fake anything. "

So I guess that anyone who is motivated can fake a digital signature too!

😉

[Bernd Alheit]

This is not possible.

[JR Boulay]

Several ways to fake PDF with digital signature:

https://sudonull.com/post/32355-Several-ways-to-fake-PDF-with-digital-signature

[Bernd Alheit]

Where does this fake the digital signature?

[Test Screen Name]

"So I guess that anyone who is motivated can fake a digital signature too!"

You can't fake an actual certificate without the private key, but people do need to learn how to read the signature properties.

You can make a digital self-sign certificate in any name at all. So can anyone else. So these have no value, they don't even have to be faked. But a certificate issued by a recognised trust company does ID checks. 

Unfortunately, many people don't even look at the signature panel. This is clear from the many message from people who are concerned what the on-page appearance looks like. When I hear this question, I fear this company - because it has not given enough training - is going to be the victim of fakes. I would like on-page appearances banned completely, as a security risk, just as Flash was. No excuses, they are dangerous.

[baztuz]

I have technology that can address this but the PDF just needs to be tokenized first. After tokenization it can be authenticated at any time after. No need to sign the PDF. Just tokenize. And you can put anything in the token too. Like biometrics, valid ID, video or a picture. The PDF opens normally with any compliant PDF reader.

[Antonio3173926742gc]

Does this technology allow you to open the PDF and it would tell which parts of the PDF were edited? 

[baztuz]

Yes. May I ask how large the PDFs are normally? Hundred page contracts?

[Antonio3173926742gc]

The PDFs would be either Bank Statements (2-3 pages) or legal contracts
that are about 10-20 pages long.

Thanks

[BETS06]

Does it have to be tokenized prior to the edits to view which edits were done?

[Joseph364176090e93]

Hey. Any chance you can help.

I am at the work tribunal this week coming and I have just received my ex employers evidence bundle. Inside the bundle is a training agreement which I suspect to be edited. I only have the print out version. Is there any way to confirm this has been edited?

Thanks 

[try67]

If it wasn't digitally signed it's very difficult to do so. But if you have a printed copy you can compare the two manually.