How to Analyze a Potentially Altered or Fraudulent PDF
Question details
The user wants to know how to determine if a PDF file, such as an email record or contract, has been modified, tampered with, or forged.
- Product
- Device & OS
- not provided
- Scenario
- Verifying the authenticity and integrity of a suspicious PDF document for personal, legal, or financial reasons.
- Observed behavior
- The user suspects the PDF content has been changed and needs methods to examine the original structure, metadata, and evidence of alteration.
Before analyzing the document, make sure to preserve the original PDF file without making any edits or saving it again, as doing so can permanently overwrite crucial metadata and timestamps.
Review Document Metadata and Properties
Examining the document's hidden metadata is the most reliable first step in identifying unauthorized modifications or spotting discrepancies in the file's history.
Every PDF contains embedded properties that record when the document was created, when it was last modified, and the software used to generate it. Significant gaps between creation and modification dates can be an indicator of tampering.
Open the PDF in your standard PDF reader, navigate to the 'File' or 'Menu' section, and select 'Properties' (often accessible via the Ctrl+D or Cmd+D keyboard shortcut).
Look at the 'Created' and 'Modified' dates. If the modification date is significantly later than the creation date, or if it aligns with the time you received the suspicious file, the document may have been altered after its initial generation.
Review the 'Application' or 'PDF Producer' field. If an email record or bank statement was allegedly generated by an official system but the metadata shows it was produced by a consumer photo-editing or standard PDF-editing software, it is highly likely a forgery.
Inspect Visual Elements and Document Structure
Manual visual inspection can often reveal poorly executed forgeries, such as mismatched text, overlapping objects, or inconsistent formatting.
Consult a Digital Forensics Professional
For high-stakes legal or financial disputes, a professional forensic analysis provides defensible, expert proof of document tampering.
Examine PDF Properties with WPS Office
WPS Office includes a comprehensive built-in PDF reader that allows you to easily view document properties, metadata, and security settings to help you verify a file's integrity.
- 1. Open the PDF: Launch WPS Office and open the suspicious PDF file you wish to analyze.
- 2. Access Properties: Click on the 'Menu' button in the top left corner, then navigate to the 'Document Properties' option.
- 3. Review the Metadata: Examine the 'Description' tab for creation dates, modification timestamps, and the original software producer to spot any discrepancies.
- 4. Check Embedded Fonts: Navigate to the 'Fonts' tab within Document Properties to see if unusual or mismatched fonts have been embedded, which could indicate tampering.
Frequently Asked Questions
Can I tell exactly what text was edited in a tampered PDF?
Generally, no. Unless the PDF was specifically saved with revision tracking or incremental updates enabled, you can usually only see evidence that the file was modified, not the exact textual changes that were made.
Do incorrect timestamps definitively prove a PDF was forged?
Timestamps are strong indicators, but they can be spoofed by someone changing their computer's system clock before saving the file. They should always be evaluated alongside other forensic evidence like visual inconsistencies and object structures.
How do digital signatures prevent PDF alteration?
A cryptographic digital signature locks the state of the document at the time of signing. If anyone modifies the PDF after it is signed, the signature validation process will immediately display an 'Invalid' or 'Altered' warning.
Can metadata be completely removed from a PDF?
Yes, specialized tools and certain PDF editors exist to scrub or sanitize metadata from PDF files. Ironically, a complete lack of metadata in an otherwise complex business document can sometimes be a red flag for intentional tampering.
