How to Check if a PDF Has Been Edited or Tampered With

In November 2023, during pre-trial discovery in a commercial arbitration, a defence team submitted a 14-page employment agreement. The typography was clean, the corporate header sharp, and the signature on the final page looked authentic.

A basic forensic check destroyed the appearance of authenticity. The CreationDate recorded 09:14 on 12 March 2021. The ModDate recorded an update on 4 October 2023 — two weeks after the dispute had begun. The XMP history stream showed the file had been opened and re-saved in Adobe Acrobat Pro, with one paragraph converted to paths.

What looked like an original signed contract was a retroactively modified PDF. Knowing how to check if a PDF has been edited is no longer a specialist skill. It is a practical requirement for lawyers, journalists, compliance teams, and anyone who must rely on the integrity of a document.

#1 Why PDFs can be edited without obvious signs

PDF is not a simple format. The PDF 1.7 specification (now maintained by ISO as ISO 32000) allows a document to be modified in several ways that leave no visible trace on the printed page.

The most significant of these is the incremental update mechanism. When a PDF is edited after initial creation, most editors — including Adobe Acrobat, Foxit, and PDF-XChange — append the changes to the end of the file rather than rewriting it from scratch. The original content remains in the file body. The new content is layered on top. Both versions coexist in the same file.

This architecture exists for good reasons: it's efficient, and it enables digital signatures to cover specific versions of a document. But it also means that a document can contain significant edits while appearing completely normal when opened in a PDF viewer.

Beyond incremental updates, metadata fields — including the modification timestamp — can be cleared or overwritten. A sophisticated actor can delete the ModDate field entirely, set it to match the CreationDate, or change the Producer field to hide which software was used to make the edit. This is why no single method is sufficient. A complete check requires looking at several layers simultaneously.

#2 Six methods to detect PDF editing

#3 Before and after — what tampered metadata actually looks like

This is the most important section if you're trying to evaluate a specific document. Below are two ExifTool outputs: one from an unmodified PDF, one from a document that was edited and had its metadata partially cleaned. The differences are subtle but decisive.

The tampered document tells a clear story: it was originally exported from Word on 14 March, then opened in Foxit PhantomPDF on 2 April, edited, and saved. The person who edited it didn't clear the metadata — a common mistake, because most people don't know ExifTool can read both the Info dictionary and the XMP stream independently.

The MetadataDate field is particularly revealing. It records when the metadata itself was last written, which is often a few seconds after the document was saved. A MetadataDate later than ModifyDate is unusual and suggests the file was processed by a second tool after the primary edit.

#4 The exact command to run

If you have ExifTool installed, this single command extracts everything relevant for tampering detection:

A count of 1 from the %%EOF grep means no incremental updates. A count of 2 or more means the file was modified after initial creation, with each additional count representing one more round of editing.

#5 Limitations — what these methods cannot detect

Honest forensic practice requires stating what the methods cannot do, not just what they can.

#6 Legal context — when PDF tampering becomes a serious matter

Document authentication is a foundational concept in law. In the United States, Federal Rules of Evidence Rule 901 requires that documents be authenticated before admission as evidence. A PDF with detectable signs of post-creation modification is subject to challenge under this rule.

In England and Wales, the Civil Evidence Act 1968 Section 8 and subsequent case law establish that documents produced by computer are admissible but subject to challenge where the integrity of the producing system cannot be established. PDF forensic evidence has been accepted in UK courts as a method of challenging document integrity.

Courts have excluded documents in proceedings where PDF tampering was demonstrated — not because PDFs are inherently unreliable, but because specific documents showed specific evidence of post-creation modification that the submitting party could not explain.

For legal professionals, this means two things. First, documents you receive as PDFs should be checked for integrity before being relied upon, particularly in disputes. Second, documents you produce and share as PDFs carry metadata that could be forensically analysed. Our article on PDF metadata removal for legal teams covers the production side of this equation.

#7 The complete PDF tampering verification checklist

#8 What a genuinely unmodified PDF looks like

It's useful to know the positive case, not just the negative one. A PDF that has not been edited after initial creation typically shows:

No single indicator is conclusive on its own. A file with identical creation and modification dates could have been edited and cleaned. A file with mismatched dates could be legitimate — some PDF workflows touch the ModDate as part of normal processing. The strength of the case comes from multiple indicators pointing in the same direction.

#9 Protecting your own documents from tampering claims

If you're producing documents rather than analysing received ones, the same forensic knowledge applies in reverse. Two practices reduce your exposure.

Apply a digital signature before sharing. A cryptographic signature over the content creates a verifiable record that the document has not changed since you signed it. Adobe Acrobat Pro, DocuSign, and several other tools support this. The signature doesn't prevent editing — but it makes any post-signing modification detectable.

Strip metadata before sharing. Your documents carry metadata that reveals your editing history, software, and sometimes internal author information that has no relevance to the recipient. Stripping this before distribution is standard practice in legal and compliance contexts, and it reduces the forensic surface area of your document. Our PDF Metadata Remover handles all three metadata layers — the Info dictionary, trailer dictionary entries, and the XMP stream — and runs entirely in your browser. See also our guide on redaction vs metadata removal for how these two operations differ.

This article is for general informational purposes about PDF forensics and document verification. It is not legal advice. For advice specific to litigation, evidence law, or forensic proceedings in your jurisdiction, consult a qualified legal professional or certified digital forensics examiner.