Which PDF Tools Leave Tampering Traces? A Field Guide
This article is a snapshot – content was accurate as of October 2026 (code examples tested against the API as of October 2026). The product evolves actively; specific counts, examples, and detection rules may have changed since publication – see the changelog for the current state.
A PDF lands in your queue from a workflow you can’t see. The applicant says it’s the statement their bank issued, and it may be exactly that. It may also have passed through a desktop editor, an online converter, a phone scanner app or a ‘Print to PDF’ dialog on its way to you. The useful question for a reviewer is not ‘which tool made this?’ It is ‘what can I conclude from this file, and when do I ask for the original?’
This guide walks through the classes of tool a document can meet between issuer and reviewer, and what each one can leave in the file.
The short answer
Tools that touch an existing PDF generally leave something behind. What you can conclude depends less on the brand of tool than on what happened to the file after it was issued.
HTPBE? reads a PDF’s structure for evidence that it was modified after creation. It does not establish that a document is authentic, that its issuer exists or that the figures on the page are correct. Within that boundary, three properties of the format shape the outcome:
- Edits can be appended. The PDF format lets a tool add changes after the original bytes, so earlier versions of the file can remain inside it (ISO 32000-1, §7.5.6).
- There is more than one record of origin. A PDF keeps more than one record of who made it and when, and editing tools don’t always keep those records in step (ISO 32000-1, §14.3).
- A file can be rebuilt. When a document is printed, re-exported or scanned into a new PDF, the earlier history is no longer part of the file, and the right next step is to ask for the issuer’s original.
Check the file, not the tool, and ask for the original when the file can’t answer for itself.
How to read this guide
Read the class, not the brand. Tools change their defaults between versions, and the same product can behave differently depending on which feature was used. If you want brand-level detail, the per-tool catalogue covers individual editors. This guide stays one level up.
Each section describes what the class does to a file, what a reviewer can reasonably conclude, and the question worth asking. Three readings come up across the classes below:
- Edit history readable. The file still carries evidence of work done after it was created. Named markers describe what kind.
- Context decides. The tool has routine, legitimate uses, so its presence alone is not treated as tampering. The file is still not the document as the issuer sent it.
- File rebuilt. The earlier history isn’t in the file any more. It can’t be confirmed as an original. That is a limit of the evidence, not an accusation.
The sections follow the order in which a reviewer tends to meet these tools in a working queue. It is not a ranking. We also deliberately don’t publish a table of what survives each tool and what doesn’t, for the same reason the print-to-PDF article gives: it would be a map for the wrong reader.
Desktop PDF editors
This is the class most people picture. Someone opens an issued PDF in a full desktop editor, changes something and saves.
Editing an issued PDF in a desktop editor can leave evidence of a second writing session or of a different tool working on the page. Because changes can be appended after the original bytes, the file can still contain the version it started as. And because the file keeps more than one record of its origin, a second tool saving it can leave a visible mark there too. For the format-level background on appended revisions, see xref table forensics.
Where the file shows the edit, it is typically reported as modified, with markers such as HTPBE_MULTIPLE_REVISION_LAYERS or HTPBE_EDITING_TOOL_FINGERPRINT.
You can look at a file’s own records in the PDF metadata viewer, and the guide to viewing a PDF’s edit history explains what you are looking at.
Reviewer’s question: was this file touched after the issuer produced it, and does the submitter have a reason for that? A redaction, a highlighted line or an added note is an edit too.
Word processors and office re-export
A common variant: the PDF is opened in a word processor or office suite, adjusted, and exported to PDF again.
Opening a PDF in a word processor and exporting it again replaces the issuer’s provenance. Where the file shows the re-export or another change, it is typically reported as modified, with markers such as HTPBE_REEXPORTED_THROUGH_OFFICE_SUITE.
Reviewer’s question: is this the issuer’s file, or a copy someone rebuilt? Either way, the original is the document to ask for.
Online editors and converters
Browser-based editors, compressors and format converters are everywhere, and plenty of honest people use them. Shrinking an attachment to get under an upload limit is a common reason.
Online editors and converters work on existing PDFs, so passing through one is itself post-creation processing. Where the service’s processing shows, the file is typically reported as modified, with markers such as HTPBE_ONLINE_EDITOR_ORIGIN.
Reviewer’s question: why did this document need to go through a web service before it reached you? Compression is a fine answer. It still means you are not looking at the issuer’s file.
Forms, fill-and-sign and annotation tools
Some documents are meant to be added to. Application forms get filled in, contracts get signed, reviewers mark things up.
Forms, fill-and-sign and markup tools legitimately add to a document, so their presence alone is not treated as tampering. Where the added layer substitutes the document’s own values, the file is typically reported as modified. Markers here include HTPBE_BURNED_IN_ANNOTATIONS and HTPBE_WIDGET_APPEARANCE_MISMATCH, both describing a change to what the page shows after it was created.
Reviewer’s question: is the added layer an addition, or does it replace something the document already said?
Merge, split and page-assembly tools
Applicants combine files constantly: three months of statements in one upload, a payslip followed by an employment letter. Merging is legitimate, and an edit is not fraud.
When pages show signs of coming from different sources, the file is typically reported as modified, whichever tool combined them, with markers such as HTPBE_PAGES_FROM_MULTIPLE_SOURCES.
Reviewer’s question: should these pages have come from one source? If the submitter merged separate genuine documents, ask for them separately.
Print-to-PDF, re-distilling and ‘save as new’
Printing a PDF to a new PDF, or re-saving it as a fresh file, is routine. People do it to archive, to share a read-only copy, or simply because it was the button they knew.
Printing or re-saving a document into a new PDF destroys its editing history. Where the file shows the rebuild, it is typically reported as modified, with markers such as HTPBE_PRINTED_OUT_OF_PDF_READER or HTPBE_FLATTENED_EDIT_HISTORY.
The full reasoning, including why a reprinted bank statement should prompt a request for the original, is in how to tell if a PDF was flattened.
Reviewer’s question: why was this document reprinted rather than forwarded as the issuer sent it? A reasonable answer is fine – the issuer’s file is still the one to ask for.
Scans, phone photos and screenshots
Not everyone has a digital original. Some documents only ever existed on paper, and a phone scan is the honest way to submit them.
A scan, phone photo or screenshot of a document carries no editing history of the original. Where the file shows it was produced or changed in software, it is typically reported as modified, with markers such as HTPBE_FAKE_SCANNER_ORIGIN or HTPBE_TEXT_OVERLAY_ON_SCAN.
Reviewer’s question: was there ever a digital original I could ask for? If the issuer produces documents electronically, that file is the one to request.
Scripts and libraries that rewrite a file
The last class is code: a script can open an existing PDF and write it back out.
Rewriting an existing PDF in code changes how the file was put together, and that change is itself a trace. Where the rewrite shows, the file is typically reported as modified, with markers such as HTPBE_TOOL_VS_STRUCTURE_MISMATCH or HTPBE_IDENTITY_OVERWRITTEN. How generator libraries differ from each other is covered in PDF generator fingerprints.
Reviewer’s question: did this file reach you straight from the issuer’s system, or did someone else’s code write it last? If the latter, ask for the copy the issuer produced.
Signatures cut across every class
Any of the tools above can be the one that touches a signed document, so signatures deserve their own note.
A digital signature covers the file as it was at signing, and later writes are structurally visible (ISO 32000-1, §12.8). Changes made after a document was signed, or a removed signature, are among the clearest traces a file can carry: HTPBE_POST_SIGNATURE_EDIT and HTPBE_SIGNATURE_REMOVED.
A signature on its own never makes a file an unedited original, and this analysis does not validate certificates. If you need to know whether a certificate chains to a trusted authority, use a signature-validation tool alongside it.
The pattern across all eight classes
Read the sections together and one lesson repeats: rebuilding a file changes what can be concluded about it. It does not produce an unedited original.
A file that still shows evidence of what was done to it and a file that can’t be cleared as the issuer’s output lead to the same practical question: can this file answer for itself, or do you need the original? Neither outcome is a verdict on the person who sent it.
That is also why the brand question matters less than it seems. The name a tool writes into a file is a claim, not proof, as the Adobe producer spoofing case study shows. What the file’s structure says about its history is the part worth reading. Check the file, not the tool.
What to do with each outcome
Route on the verdict, not on the tool you suspect. If files reach you through the HTPBE? API, these are the three values you branch on. A fuller recap of the three verdicts is in what inconclusive means.
| Verdict | What it means | What to do |
|---|---|---|
modified | Structural evidence that the file was changed after creation. The named markers say what kind of change. | Route to manual review with the markers as the audit trail. Ask for the original. Evidence of an edit is not, by itself, evidence of fraud. |
inconclusive | The file can’t be cleared: nothing in it confirms it as the issuer’s original. | Treat it as not cleared: request the original or route to manual review. Operationally it carries the same weight as any file that needs a human. |
intact | No evidence of modification was found, and nothing in the file prevented it from being cleared. | Continue your normal checks. intact does not mean the contents are true or that the issuer is real. |
What this cannot tell you
- Content that was false from the start leaves no trace of editing, because nothing was changed after the file was produced. A file from consumer software comes back
inconclusiverather thanintactfor this reason: its structure can’t vouch for a file anyone could have produced from scratch. - No finding is not proof of authenticity.
intactmeans no disqualifying evidence was found, not that the contents are true. inconclusiveis neither a failure nor a pass. Nothing in the file confirms it as the issuer’s original.- Evidence of an edit is not evidence of fraud. Redactions, form fills and merges are edits too. Intent is for the reviewer to judge.
- The analysis is structural. HTPBE? does not read, compare or recalculate values on the page, and it does not validate signatures or certificates.
Frequently Asked Questions
Does re-saving a PDF always mean it was tampered with?
No. Re-saving, compressing, merging and printing to PDF are everyday actions. They change what the file can prove about itself, but intent is a separate question for the reviewer.
Is inconclusive a bad result?
It is a result that needs a person. It means the file can’t be cleared as the issuer’s original, so the next step is to request the original or route the file to manual review. It is not an accusation, and it is not a pass either.
Does the Producer field prove which tool made a PDF?
No. It is a text field that any tool can write and anyone can change. It is a starting point, not a conclusion; the file’s structure carries more weight.
Checking files at the point they arrive
If PDFs reach you from workflows you can’t see, the HTPBE? API checks each one as it comes in: one POST to submit the file’s URL, one GET to read the result. You route on intact, modified or inconclusive, and the named markers stay with the case as the audit trail for whoever reviews it.
To try it on a single file first, create an account. You get 5 welcome credits on signup, then it’s pay-per-check – see pricing for the options.