A PDF usually does not contain a complete, trustworthy edit history. You can check for modification clues—such as a later modification date, a different Producer value, incremental saves, or a changed digital signature—but no single clue proves what was edited or who edited it.
The useful question is not “Does this file have one suspicious field?” It is “Do the file's technical clues agree with the way this document was supposedly created, signed, and delivered?” Use the workflow below to build that answer.
Fast answer
- Preserve the file you received; inspect a copy.
- Compare CreationDate, ModDate, Creator, and Producer.
- Check any digital signature and what portion of the file it covers.
- Compare the document with a trusted original or issuer record.
- Escalate high-stakes inconsistencies instead of guessing.
1. Preserve the Original File
Do not open a suspicious file in an editor and save over it. Keep the received copy unchanged, note where it came from, and record when you received it. For important work, calculate a SHA-256 checksum so you can show which exact bytes you inspected.
This does not prove the file was genuine when it arrived. It prevents your own troubleshooting from changing the evidence you already have.
2. Read the Metadata as Clues
Run the unchanged copy through the PDF metadata checker. Start with four fields:
| Field | What it can tell you | What it cannot prove |
|---|---|---|
| CreationDate | When software recorded creation of this PDF instance | When the visible content was first written |
| ModDate | When software recorded a later save or update | Which words, pages, or values changed |
| Creator | The source application that claims to have created the content | The identity of the person who used it |
| Producer | The software that generated or last wrote the PDF | Whether that software made a deceptive edit |
Adobe documents both the older Document Information dictionary and XMP metadata. A file may contain both, and their values can disagree. That mismatch deserves review, but it can also come from a normal conversion, accessibility pass, signing step, or metadata cleanup.
Dates deserve the same restraint. A ModDate later than CreationDate means the file records a later operation. It does not tell you whether the change was a corrected typo, a signature, an OCR layer, a malicious amount change, or simply a new export.
3. Check the Software Trail Against the Claimed Workflow
Software names become useful when you have an expectation. A contract drafted in Word, exported by Microsoft, and then signed in Acrobat has a plausible trail. A supposedly untouched bank-generated statement whose Producer names a general PDF editor needs an explanation.
Do not turn a software name into an accusation. Ask the sender or issuer how the document was produced. Some portals, scanners, print drivers, e-signature services, and archival systems rewrite PDFs during legitimate processing.
4. Validate Digital Signatures Separately
A cryptographic signature can provide stronger evidence than ordinary metadata, but only when you validate the signature, certificate trust, signing time, and document coverage. Use the PDF signature checker for structural clues, then use a trusted desktop validator for the certificate chain and revocation status.
Important: “Signature found” is not the same as “signature valid.” A warning can mean the signed bytes changed, the certificate is untrusted or expired, validation data is unavailable, or the signature covers only part of the document.
5. Look for Structural Revisions
PDFs can be updated incrementally: new objects and a new cross-reference section are appended while earlier bytes remain. PDF Association explains that this behavior supports changes such as signatures and annotations. It can preserve clues about earlier states, but a later rewrite or optimization can flatten them.
Use the PDF validator to check parseability and structure. Treat incremental sections, duplicate objects, unusual object order, or parser warnings as leads for deeper review—not automatic proof of tampering.
6. Compare Against a Trusted Source
The strongest practical check is often outside the PDF. Download the document again from the issuer's official portal, ask the issuer to confirm key values, or compare it with a known-good copy. If you have two versions, compare page count, visible text, amounts, dates, signatures, attachments, and checksums.
For invoices, contracts, certificates, medical records, or financial documents, verify through a contact method you already trust. Do not rely on phone numbers or links found only inside the questioned file.
How to Interpret the Result
| What you found | Reasonable next step |
|---|---|
| Metadata and software trail match the known workflow | Record the result, but do not call it proof of authenticity |
| One unexplained date or software mismatch | Ask the issuer how the file was created and delivered |
| Signature invalid after a recorded modification | Stop relying on the file until the signer or issuer confirms it |
| Several conflicting clues or high financial/legal impact | Preserve evidence and involve a qualified forensic or legal professional |
What PDFCheck Can and Cannot Do
PDFCheck can surface metadata, software fingerprints, signature structures, PDF version, and validation clues. It can help you decide what to investigate next.
It cannot prove authorship, intent, legal validity, or exactly what changed. Metadata is editable; structural evidence can be removed by rewriting the file; and a visually convincing document can still contain false information. For a broader trust workflow, continue with how to verify PDF authenticity.