How to tell if a PDF was edited

The short answer

Look at four things: the creation and modification dates, the software named in the file, whether the file was saved in more than one stage, and whether it carries a valid digital signature. Only the last one can actually prove that a document hasn’t changed since it was signed. The others are useful signals that ordinary editing also produces.

Created and modified dates

Most PDFs store CreationDate and ModDate. If the modification date is later, something saved the file again after it was made. That includes harmless things: filling in a form, adding a comment, or simply re-saving in a viewer.

A modification date earlier than the creation date is worth noticing, because it can’t happen in normal use. It usually points to a wrong computer clock or a conversion between tools, and sometimes to properties edited by hand. Either way, both dates come from computer clocks and can be changed with free tools.

Creator and producer

The creator is the app the document was written in, and the producer is the software that wrote the PDF. A bank statement whose producer is a consumer PDF editor rather than the bank’s own reporting system is a reason to look closer. Many legitimate workflows also pass documents through several tools, so treat it as a question, not an answer.

Saved in stages

PDFs can be updated by appending changes to the end of the file instead of rewriting it, which is called an incremental save. Each save adds a new cross-reference section, so counting them shows how many times the file was updated this way. Metvoro reports this as “saved in N stages”.

Incremental saves are how signatures, form filling and annotations normally work, so they are expected in many documents. They also mean earlier versions of the content may still be inside the file.

Digital signatures

A digital signature covers a specific range of bytes. If anything in that range changes, validation fails. That makes signatures the only part of this list that can show a document is unchanged. Metvoro detects signatures but doesn’t validate them. Use a PDF reader such as Adobe Acrobat Reader, or a qualified validation service, to check them.

What you can’t conclude

• Clean metadata doesn’t prove a PDF is original. Metadata is easy to rewrite or remove.
• Changed metadata doesn’t prove fraud. Normal tools change it all the time.
• For anything with legal or financial consequences, ask the sender for the original or a signed copy, and validate the signature.