A PDF can look settled on the screen while its internal history is still talking. In this insurance dispute, the visible date pointed to 2021. The activity recorded inside the file pointed elsewhere: July 2022, September 2022, and January 2023.
That mismatch did not answer every question. It did answer the first one: the document could not be evaluated responsibly by looking at the page alone.
In brief: Our examination found a sequence of text-field entries, line annotations, highlights, and top-level metadata that did not support the document’s claimed 2021 history. The findings showed why attorneys should preserve native PDFs, related emails, and the computer used to create or edit them.
This case study omits identifying details. Its findings apply to the files examined in this matter; PDF metadata must be interpreted in context and is not, by itself, proof of who performed an action.
The question behind the file
An attorney contacted us in March 2023 with two PDF documents and a straightforward question: had someone signed physical paper and scanned it, or had signatures and other content been added later?
We also received a report prepared by an unidentified person at a small computer shop. That report becomes important later in this series. First, we had to establish what files we actually possessed.
One copy of Evidence Item 1 arrived as a direct email attachment. Another arrived inside a forwarded .eml file, a saved email message that preserves message structure and attachments. The Internet Message Format specification describes an email message as header fields followed by an optional body; retaining the original message container can preserve context that a loose attachment does not. RFC 5322: Internet Message Format
The two PDFs had different filenames, but both produced the same MD5 hash value:
dea2a1838e533f89072f44267be727b4
A hash value is used in digital evidence work to support integrity checks and comparisons against known data. NIST’s forensic-science definition of a hash value In this examination, the matching value supported treating the two received copies as the same content. Because MD5 is an older algorithm with known collision weaknesses, a modern preservation workflow should also record a stronger hash such as SHA-256. The point is not blind faith in a number; it is a documented comparison that another examiner can repeat.
Same file. Different route into the case. That distinction matters.
A PDF is a collection of objects, not a digital sheet of paper
To a user, a PDF is a page. Internally, it is a structured file containing objects that may represent text fields, annotations, images, signatures, fonts, and metadata.
PDFs can store dates in a native string format that begins with D:. The PDF reference describes the pattern as:
D:YYYYMMDDHHmmSSOHH'mm'
The fields represent the local date and time plus an optional relationship to Universal Time. Adobe PDF Reference, section 3.8.3
A PDF may also carry Extensible Metadata Platform (XMP) information represented through XML-based metadata. Adobe describes XMP as embedded labeling technology and notes that PDF metadata can include author, creation, and modification information. Adobe Acrobat SDK: Metadata and XMP
Neither format is a magic truth machine. Dates can be changed, omitted, regenerated, or stripped. Their value comes from relationships: which object contains the date, what that object does, whether other objects agree, and whether external evidence supports the sequence.
The activity timeline inside Evidence Item 1
Our analysis identified 14 dated instances of user activity. The most useful events formed three clusters.
July 6, 2022: fields and lines appear
At 1:48 a.m. Central Daylight Time, a text field associated with the PDF creator’s client was recorded. Between 1:52:44 and 1:53:13 a.m., four line annotations were created. Those annotations carried a user name and creation or modification dates.
The timestamps were seconds apart. Like a data logger on a track car, the sequence did not explain the driver’s intent, but it did record the order in which the events occurred.
September 2, 2022: claim information and highlights are added
The next cluster included:
- A text field containing an address
- Two highlighted passages
- A claim-number field
- Another client-name field
- A text field containing a date presented in the document as an earlier operative date
- Creation and modification activity for another highlight
The entries ran from 9:46 a.m. through 3:41 p.m. Central Daylight Time. They were not random file-system times sitting outside the PDF. They were associated with specific objects and visible edits inside it.
January 9, 2023: top-level creation metadata
The file also contained a top-level creation date of January 9, 2023, recorded in UTC.
That date did not erase the earlier object-level activity. Instead, it added another inconsistency to a file alleged to have existed in 2021. The defensible conclusion was narrower than “a timestamp solved the case” and more useful: the internal timeline did not support the claimed history, and the earliest activity we could identify in this file was July 6, 2022.
The underlying text might have existed earlier in another file type or on another computer. We did not have evidence establishing that. A forensic opinion should stop where the evidence stops—even when everyone in the room would prefer one more sentence.
Software traces narrowed the possibilities, but not to one application
The file contained remnants consistent with an Adobe product and Adobe Fill & Sign. It also contained references to PDFium, the open-source PDF library used by Chromium-based software. Those traces mattered, but they did not identify one exact editing application or one exact person.
PDFium can be incorporated into many programs. Adobe-related objects can survive a workflow involving more than one application. A user name stored in an annotation may come from an application profile, the logged-in operating-system account, or an earlier source document. Without the creating computer, attributing the edits to a person would have outrun the evidence.
What the timeline established
The analysis supported four findings:
- The two received copies of Evidence Item 1 matched for the comparison performed.
- The PDF contained dated object-level activity in July and September 2022.
- It also contained a top-level creation date in January 2023.
- The file’s internal history did not support the allegation that this PDF, in this form, existed in 2021.
That fourth point is the heart of the case. Not because metadata is infallible. Because multiple pieces of internal evidence, tied to specific edits, told a story that the visible page did not.
What attorneys should preserve when a PDF date is disputed
If a PDF’s origin or signing history may matter, preserve more than the printed page:
- The native PDF exactly as received
- The original email message, preferably in a container format such as EML or MSG
- All alternate versions and attachments
- The source computer or a forensically sound image of it
- Cloud-storage history, if relevant and lawfully available
- The surrounding communications that explain when the document was requested, sent, or revised
- Hash values recorded at collection and during later transfers
Printing should be the last resort, not the first investigative step. A printout can preserve appearance while discarding the objects that explain how the page came together. It is the forensic equivalent of photographing an engine and throwing away the car.
The practical lesson
A suspicious date should not trigger a hunt for one convenient metadata field. It should trigger preservation and a timeline.
Start with the native file. Confirm the copies. Identify the objects. Compare the dates. Then ask what evidence is missing—especially the computer that created or edited the document.
If a PDF is central to an insurance or litigation matter, Cyber Agents can help counsel preserve and examine the native evidence before a preventable conversion strips away the useful history. Contact Cyber Agents
trent struttmann Digital Forensics 0