PDF Document
| Format | PDF Document |
|---|---|
| Short name | |
| Category | document |
| Platforms | Windows, macOS, Linux, iOS, Android, QNX |
| Crush support | Supported (PDFParser) |
| Status | Reviewed |
| Last reviewed | 2026-10-04 |
Forensic relevance
Portable Document Format — used pervasively for official documents, reports, forms, contracts, and communications. Two metadata layers: DocInfo dictionary (Author, Title, Creator, Producer, CreationDate, ModDate in D:YYYYMMDDHHmmSSOHH'mm' format including timezone) and XMP stream (richer, XML-based, with InstanceID, DocumentID, history). Creator identifies the authoring application (Word, LibreOffice, InDesign); Producer identifies the PDF engine (Acrobat, Ghostscript, pdfTeX) — mismatch between claimed document origin and Creator/Producer is a key fraud indicator (e.g. Creator: Canva on a bank statement). Incremental updates append new cross-reference tables (xref) without overwriting — each save event is preserved and recoverable. xref count > 1 indicates the document was saved multiple times — except in linearized ('Fast Web View') files, which have two xref sections from the start; this structural record is harder to falsify than metadata fields. Earlier content versions (pre-redaction text, prior dates) may be recoverable from superseded objects in the same file. Can embed files, JavaScript (malware vector), digital signatures, and hidden layers (Optional Content Groups). Absent metadata on institutional documents is itself a fraud indicator.
Signatures
| Offset | Hex | ASCII (non-printable as .) | Description |
|---|---|---|---|
| offset 0 (0x0) | 25 50 44 46 2D | %PDF- | PDF header ('%PDF-') |
Known extensions
References
- ISO 32000-2:2020 — PDF 2.0 specification (free via PDF Association) https://pdfa.org/resource/iso-32000-2/
- PDF metadata forensics — field-by-field reference (HTPBE, 2026) https://htpbe.tech/blog/pdf-metadata-fields-complete-reference
- PDF forensics and XMP metadata streams (Meridian Discovery) https://www.meridiandiscovery.com/articles/pdf-forensic-analysis-xmp-metadata/
- PDF forensics and the metadata conundrum (PDF Association, Cherie Ekholm, 2025) https://pdfa.org/presentation/pdf-forensics-and-the-metadata-conundrum/
- ExifTool — PDF metadata extraction https://exiftool.org/
Cite this entry
Crush Format Reference, “PDF Document”. https://kalink0.github.io/crush-forensics/formats/pdf/ — source: crush/data/build_formats_db.py at commit 640a2a9928f4e36a976b89901512a8dce824d093, built 2026-10-21 06:46:19 UTC.
Entry in the source at this commit · Change history of the source · Report a correction