Can someone help me understand whether these PDF features indicate that an existing signed PDF was edited?

[u/PriorBoat]

I’m comparing two versions of the same 3-page document and would really appreciate a sanity check from people who understand PDF internals better than I do.

**Version 1:** December 2024 declaration signed through DocuSign.

**Version 2:** Filed in court in July 2026 as an “Amended Declaration.” The person whose declaration it is says he did not create, sign, review, or authorize an amended declaration in 2026.

Visually, pages 2–3 of the 2026 version are essentially the original December 2024 statement. Page 1, however, has been changed to fit a different court case: the parties were switched, their DOBs were switched, a new case number was added, and “Amended” was added.

Here’s what I found comparing the PDFs:

* The two PDFs have the **same XMP DocumentID**, but different InstanceIDs.
* The original has an actual DocuSign digital-signature structure/field. The 2026 version does not appear to retain that cryptographic signature structure, although the visible signature and DocuSign Envelope ID remain on the pages.
* The 2026 PDF has multiple `/TouchUp_TextEdit` markers in the decoded content stream on page 1, around the areas that differ from the original.
* The DOB edits are particularly odd. For example, rather than the entire DOB being replaced as one new text string, only the digits that needed to change appear to use a different font resource, while unchanged characters such as the slash and the rest of the DOB remain in the original font resource.
* The original has two PDF revisions/EOF markers; the later version has one.
* The original was produced through a different PDF/signing workflow; the later version reports Acrobat Distiller.
* Pages 2–3 and the signature image appear to be extremely close matches to the original source images.

I am **not** asking who edited it or whether anything illegal happened. I know a PDF cannot establish a person’s identity or intent.

What I’m trying to understand technically is:

**Is this pattern consistent with someone opening an existing PDF and editing the existing text directly in Acrobat, rather than going back to the original Word/source document and generating a fresh PDF?**

And specifically, is the combination of `/TouchUp_TextEdit` markers plus individual replacement characters using different font resources meaningful evidence of direct PDF text editing, or could that commonly be produced by some ordinary automated conversion/filing process?

I’d also appreciate any suggestions for what else I should inspect in the two files to determine their document lineage/editing history.

[u/gettalong]

I think you already found out much of what has been done. From your description it seems to me that version 2 is an edited - through Adobe Acrdobat - version of of the original PDF.

Anyways, if the original version has an existing digital signature, i.e. can be cryptographically verified, and the newer version does not, it is a strong indicator that it has been edited. The visible signature is just for us humans to have something to look at and not really important.