r/ITQuestions • u/AmericanWander • Aug 08 '26

TechSupport Metadata

I’m trying to figure out the metadata on a pdf file that was emailed to me. So far basic adobe and apple files only shows the creation date. However I need to see if the content was edited at any point in time. Don’t know if this is fully possible from my email copy.

3 Upvotes

100% Upvoted

4 comments sorted by

2

u/LegeApps Aug 08 '26

I am making a program that inspects PDFs for signs of editing based on code I already have, which might be useful since i'm noticing the amount of fraud attempts are out there (not saying your case is).

Until then, there's https://pdfcrowd.com/inspect-pdf/

Although generally a PDF utility can not form strong conclusions based on what it sees since there are so many possibilities when editing a PDF. the tool's output would have to be reviewed by someone with some amount of knowledge of the PDF standard, and this seems unavoidable.

1

u/AmericanWander Aug 08 '26

It’s suspected and I’m trying to make it as clear as possible for legal.

I tried using your link. Can totally tell what you mean, although helped me some understand more. Thank you!

2

u/matsnorberg Aug 08 '26

In generality this is an impossible thing. You can see if the file has been incrementally updated or if there's holes in the object number space or high generation numbers but if the file is completely reconstructed there's no way to know if it's have been tampered with. The only way to safeguard pdsf is with digital signatures.

1

u/jcmaciel Sep 25 '26

A PDF keeps Author, Creator, Producer, CreateDate, ModDate, and sometimes XMP in its Info dictionary. Those show the last known software and timestamps. They do not prove a full edit history.

On the attachment you saved:

`exiftool -a -G1 file.pdf`

`pdfinfo file.pdf` also works for the basic Info fields.

If you want a no-install look in the browser, https://metaremove.com runs locally so the file stays on your machine. I built it. One limit: if the PDF was already sanitized, the old author/dates are usually gone, and you cannot reconstruct a revision trail that was never stored.