How to check if PDF was modified

I have a PDF generated by 3rd party system. Using PDF editor or els software I have modified it.
Is it possible to detect if PDF file was modified, without original file? I will add some more details. There is no encryption and no signature features. Document is created by IT system. User receives document and modifies it. Is it possible to track that change somehow? I thought that all these applications leaves some data in PDF header or somewhere encoded inside file and it is possible to check it. However properties showed by windows explorer shows nothing. so I was interested if there is something smarter than viewing properties/header in explorer.

94.7k 16 16 gold badges 137 137 silver badges 285 285 bronze badges asked Nov 2, 2009 at 22:32 218 1 1 gold badge 3 3 silver badges 11 11 bronze badges

8 Answers 8

The problem with this is that just opening the PDF on a Mac in Preview and hitting Command-S to save the file will replace both the Creation and Modification date to match the current date/time. So even the creation date will be wrong. Even novice users can unknowingly do this, so if you're trying to track someone who may be purposefully modifying the document, it may lead to a false positive.

What you're asking is just too easy to spoof and fool unfortunately.

answered Apr 20, 2016 at 21:00 Ethan Allen Ethan Allen 14.7k 25 25 gold badges 110 110 silver badges 203 203 bronze badges

You could always check the md5sum of the pdf file. I'm not sure what environment you are using but that should help get you started.

answered Nov 2, 2009 at 22:34 15.5k 2 2 gold badges 60 60 silver badges 65 65 bronze badges

It's going to be rough without the original file unless there were security features like encryption or digital signatures applied to it, which it doesn't sound like there was. Do you have access to any information at all about the original file? A file size, creation date, any of the metadata, etc.?

answered Nov 3, 2009 at 1:09 yu-chen-pdfonline-com yu-chen-pdfonline-com 131 2 2 bronze badges

If the tool used to modify the PDF is working according to the PDF spec then in the Info dictionary it should update ModDate but leave CreationDate alone. You may also see some non-zero generation numbers on the objects although it is just as possible that all the objects have been regenerated and will therefore be generation 0. The trial version of CosEdit will allow you to look at these 2 items.

If however the tool has been used to intentionally modify the PDF without leaving a trace then they would be spoofing those bits of data so they won't help you.

answered Nov 3, 2009 at 15:32 8,655 6 6 gold badges 48 48 silver badges 57 57 bronze badges

Are the users modifying the PDF using Acrobat? If so then what Danio mentioned above should work. Strictly speaking, modifying the PDF should change its ModDate or xmp:ModifyDate without changing its CreationDate. However not all tools adhere to this; quite a few simply leave all metadata untouched, so this method of checking isn't 100% reliable unless you know what PDF editor your users employ.

If the editor your users use does change ModDate or xmp:ModifyDate, then you should be able to see it in two places. One is when you open the document in Acrobat and hit Ctrl-D to view Document Properties. The Creation field and Modified field should have different timestamps. There may also be APIs that can be used to programmatically retrieve this metadata. The other way you can visualize it is to simply open the PDF in Notepad and search for the properties. Most of the document won't be human readable but these timestamps should be. If they do get changed appropriately, you can always parse for them in your application. Good luck!

answered Nov 3, 2009 at 17:44 yu-chen-pdfonline-com yu-chen-pdfonline-com 131 2 2 bronze badges

If you're using Ubuntu linux 18.04 and using Document Viewer then, you can

click on File options (3 vertical line ellipsis)
click on Properties.
look for Created / Modified fields in the Properties pop up

Beware: A sufficiently knowledgeable user can manipulate the PDF contents without changing the Created and Modified time stamps in the PDF metadata and the file system.