How to check if PDF was modified

I have a PDF generated by 3rd party system. Using PDF editor or els software I have modified it. Is it possible to detect if PDF file was modified, without original file? I will add some more details. There is no encryption and no signature features. Document is created by IT system. User receives document and modifies it. Is it possible to track that change somehow? I thought that all these applications leaves some data in PDF header or somewhere encoded inside file and it is possible to check it. However properties showed by windows explorer shows nothing. so I was interested if there is something smarter than viewing properties/header in explorer.

11 Answers

8 Down Vote

The answer provides clear and concise instructions on how to use a Java application to compare two PDF files line by line and detect any differences. It also includes an example code snippet in Java, which is the same language as the question.

1. Checksum: Compute the MD5 or SHA-256 checksums (hash values) for both your original and modified file versions, compare them to make sure they differ. Keep in mind this approach will give false positives if there's a minor difference that doesn't change the hash.
2. Object Size Comparison: PDF files are divided into logical objects which have different purposes. An object whose size changes after modification might be what you are looking for. In an unaltered version, each character will take up space (e.g. 1 byte). A slightly altered file would likely expand this to something like 2 bytes per character if it were a subset of ASCII.
3. Use PDF analysis tools: Tools exist that can give you statistics on the structure and contents of the PDF, such as text content length, images count or embedded files counts etc., which might differ after modification. There are many available online tools for this purpose.
4. Byte-by-byte Comparison: It's a last resort approach but theoretically if your alteration has only made one minor change (like adding just 2 bytes to an object, or moving the PDF pointer by just one byte), you could compare each pair of correspondingly offset bytes from the original and altered file.

Remember, these methods are not foolproof since even a small modification may be reflected in different ways on different platforms or tools: they might be more useful when working with binary files than text documents for instance. Also remember that changes can be subtle (like a space character being added at the end of a line), so using specialized software is best way to make sure you are aware of any potential malicious alterations to the document.

8 Down Vote

The answer is correct and provides a good explanation for checking if a PDF was modified. It covers several methods including using specialized tools, examining metadata, checking for version inconsistencies, embedded fonts, and comparing with the original file. However, it could be improved by providing more details on how to use these methods and what specific tools to use.

• Use a PDF analysis tool like PDF-XChange Editor or Adobe Acrobat Pro. They often have features to detect modifications.
• Look for hidden metadata within the PDF file. This might include timestamps of last modification, comments, or author information. Use a text editor or specialized tools to examine the file's raw content.
• Check for version inconsistencies. If the PDF file's version number doesn't match the version of the software used to create it, it could indicate a modification.
• Look for embedded fonts. If the font used in the PDF file is different from the original font, it could indicate a modification.
• If you have access to the original PDF file (even if it's just a copy), you can use a diff tool to compare the two files and identify any changes.

8 Down Vote

The answer is correct and provides a good explanation. It explains how to detect if a PDF file has been modified by comparing the xref table in the trailer of the file. It also provides a Python code example using the PyPDF2 library. However, the answer could be improved by providing more details on how to handle cases where the PDF file has been modified in a way that does not change the xref table.

Yes, it is possible to detect if a PDF file has been modified, even if you don't have the original file and there is no encryption or signature feature used. However, this is not a trivial task and requires a good understanding of PDF file format.

PDF files contain a structure called the "trailer," which is located at the end of the file. The trailer contains information about the file, including a cross-reference table (xref) that lists the location of all the objects in the file. When a PDF file is modified, the xref table is usually updated to reflect the changes.

You can use a PDF library or tool to parse the trailer and xref table of the PDF file and compare it with a previous version of the file. If there are any differences in the xref table, it's likely that the file has been modified.

Here's an example of how you can do this using the Python library PyPDF2:

import PyPDF2 def compare_pdfs(file1, file2): with open(file1, 'rb') as f1: pdf1 = PyPDF2.PdfFileReader(f1) trailer1 = pdf1.trailer xref1 = trailer1['/Root']['/Pages']['/Kids'][0]['/View'][0]['/Page'][0]['/Resources']['/XObject'][0]['/Subtype'] with open(file2, 'rb') as f2: pdf2 = PyPDF2.PdfFileReader(f2) trailer2 = pdf2.trailer xref2 = trailer2['/Root']['/Pages']['/Kids'][0]['/View'][0]['/Page'][0]['/Resources']['/XObject'][0]['/Subtype'] return xref1 == xref2 file1 = 'original.pdf' file2 = 'modified.pdf' if compare_pdfs(file1, file2): print('The files are identical.') else: print('The files have been modified.') 

This code extracts the xref table from the trailer of each file and compares them. If they are the same, the files are identical; otherwise, they have been modified.

Note that this is a simple example and may not work in all cases. For example, if the PDF file has been modified in a way that does not change the xref table, this code will not detect the change. Additionally, some PDF editors may modify the file in a way that preserves the original xref table, making it appear as if the file has not been modified.

Therefore, while this approach can be useful for detecting changes in PDF files, it is not foolproof and should be used in conjunction with other methods, such as checksums or digital signatures, for more robust file integrity checking.