What are incremental updates in PDF and why do they matter?
An incremental update is how a PDF records a change by appending it to the end of the file instead of rewriting the whole file. One PDF can therefore hold several versions of itself, layered on top of one another.
How it works
When an application saves incrementally, the earlier content stays in the file and a new section at the end overrides it. Most viewers show only the latest version, so the layering is invisible when you open the document.
Legitimate uses
- Adding a digital signature, including a second or third signature on the same document.
- Filling in a form.
- Adding comments, highlights or annotations.
- Quick saves in some editors.
So the presence of updates is not an accusation. A document that went through a normal signing or form workflow is expected to carry some.
Why it matters for authenticity
An edit made after a document was issued can be recorded this way too, so the update history is one of the observations HTPBE? weighs alongside the rest of the evidence. HTPBE_MULTIPLE_REVISION_LAYERS is one of the findings that can result. On a signed document, a change after signing is reported as HTPBE_POST_SIGNATURE_EDIT.
API users can see the underlying structure in the result: has_incremental_updates, update_chain_length and xref_count.
What no single observation proves
No single observation proves that a file is authentic. A document whose content was false from the start carries no trace of later editing. See Can someone create a fake document from scratch?
← Previous
Does the PDF checker read my document content?
Next →
Can a PDF be modified without detection?
Related questions
Keep reading
3 answers
How Detection Works
Yes. No detection method is complete: content that was false from the start, changes that leave no structural trace, and unreadable or locked files fall outside what HTPBE? can flag. It returns Inconclusive instead of Intact where it cannot tell.
Reading Your Results
Intact: no evidence of post-creation modification. Modified: the file was changed after it was created. Inconclusive: the file’s origin can’t vouch for it, so the check can’t clear it. Intact does not mean authentic.
Privacy, Data & Limits
HTPBE? accepts PDF files from version 1.0 to 2.0, including linearized files, forms, annotations and signed documents, up to 10 MB. It does not accept Word, Excel or image files. Password-protected files must be unlocked first.