logo
63 Forensic Checks

How HTPBE? Proves a PDF Was Altered After It Was Issued

63 forensic checks run on every file you submit – catching structural manipulation that visual review and KYC platforms miss. Under 3 seconds per document, no original file required.

Why structural analysis

Visual tools check appearance. HTPBE? checks what the software wrote.

A growing class of document fraud detection tools operates on what a PDF looks like – scanning for pixel-level inconsistencies, lighting artifacts, or unusual noise patterns. For physical documents that have been photographed, this has genuine value. For native digital PDFs – the kind a bank, payroll platform, or accounting system generates directly – it addresses the wrong question.

Sophisticated document fraud does not alter the image of a number. It replaces the underlying data while leaving the visual presentation intact. The resulting document passes every pixel-level check cleanly, because visually nothing changed.

HTPBE? examines the internal revision history, the object structure, the font assembly records, the signature coverage maps – layers that rendering engines never expose to the eye. A document can look exactly right and be structurally compromised. We find the second kind.

This is what it means to verify a PDF is genuine at the file level. Not confirming the facts a document states — proving the file itself was not edited after it was issued. If you need to know whether a PDF was modified — a date moved, a number swapped, a signature stripped — that is the question answered here, from the file’s own structure.

Every check derives from the PDF specification itself — ISO 32000, the open ISO standard that defines how a conforming PDF is built. That is why a verdict is deterministic and explainable, not a probabilistic guess: the same file always yields the same result, traceable to a rule in the spec.

63
Forensic checks per document
131
Structural signals evaluated
< 3 sec
Median analysis time
8
Forensic domains analyzed
No original needed
to compare against

Detection coverage

What the 63 checks cover

Each domain below answers a question a fraud analyst would ask by hand – did the dates contradict each other on a bank statement? was a signature stripped after signing? — automated by 63 forensic checks that flag tampered documents in seconds.

Every document runs all checks independently. Multiple findings can fire simultaneously – each reported separately with its own confidence level. Under the hood, those 63 checks evaluate 131 distinct structural signals – independent conditions we test in the file’s bytes, structure, and metadata.

9

Metadata & Timestamps

  • Recorded dates showing the document was changed after creationHTPBE_DATES_DISAGREE
  • Internal timestamp anomalies indicating a later changeHTPBE_TIMESTAMP_LAYERS_DISAGREE
  • Document properties indicating later alterationHTPBE_IDENTITY_LAYERS_DISAGREE
  • Timestamp values that are physically impossibleHTPBE_IMPOSSIBLE_TIMESTAMP
  • Date information that is malformedHTPBE_INVALID_TIMEZONE
  • Annotation dates that do not fit the document’s timelineHTPBE_ANNOTATION_PREDATES_CREATION
  • Signs that a document-unlocking or editing tool processed this fileHTPBE_UNLOCK_TOOL_RESIDUE
  • Metadata timing indicating a later changeHTPBE_XMP_DATES_DESYNCED
  • Time-zone evidence of a later changeHTPBE_TIMEZONE_LAYERS_DISAGREE
2

Digital Signatures

  • Content changed after the document was digitally signedHTPBE_POST_SIGNATURE_EDIT
  • Evidence that a digital signature was stripped after signingHTPBE_SIGNATURE_REMOVED
3

Incremental Update History

  • Saved revisions showing the document was modified after creationHTPBE_MULTIPLE_REVISION_LAYERS
  • A post-creation revision consistent with targeted alterationHTPBE_METADATA_ONLY_REVISION
  • Signs the file was rebuilt after its original productionHTPBE_FLATTENED_EDIT_HISTORY
19

Generator Fingerprinting

  • Structural evidence that contradicts the file’s stated originHTPBE_TOOL_VS_STRUCTURE_MISMATCH
  • Font handling that points to a different producerHTPBE_FONT_VS_TOOL_MISMATCH
  • Evidence of an earlier production history behind the current fileHTPBE_RESIDUAL_PRIOR_GENERATOR
  • Fingerprints of PDF editing softwareHTPBE_EDITING_TOOL_FINGERPRINT
  • Document re-saved by another tool after its original creationHTPBE_DOCUMENT_RESTAMPED_AFTER_CREATION
  • Signs of processing by an online PDF editing or conversion serviceHTPBE_ONLINE_EDITOR_ORIGIN
  • Origin information partly removed or editedHTPBE_SELECTIVE_IDENTITY_EDIT
  • Origin information replaced with that of different softwareHTPBE_IDENTITY_OVERWRITTEN
  • Metadata showing signs of having been rewrittenHTPBE_UNKNOWN_IDENTITY_CLAIM
  • Active scripting added to the document after its original creationHTPBE_SCRIPTING_ON_REEMITTED
  • Claims about the producing software that do not hold upHTPBE_LAYERED_IDENTITY_DISAGREEMENT
  • An implausible chain of production softwareHTPBE_IMPOSSIBLE_TOOL_PIPELINE
  • Identifying details stripped from the document after productionHTPBE_IDENTITY_BLANKED
  • Page content composed from separately produced partsHTPBE_DESIGN_TEMPLATE_ASSEMBLY
  • A font whose identity appears alteredHTPBE_ALTERED_TYPEFACE_IDENTITY
  • Traces of other software in the document’s productionHTPBE_TOOLCHAIN_DEFAULT_METADATA_RESIDUE
  • Signs of alteration in a document that was re-printed to PDFHTPBE_PRINT_PIPELINE_TAMPERING
  • Typography indicating the document was not produced by its stated issuerHTPBE_FONT_LAYER_INCONSISTENT_WITH_ISSUER
  • Fabricated origin details that misstate how the document was producedHTPBE_PRODUCER_IDENTITY_FORGED
8

Document Assembly

  • Pages assembled from more than one sourceHTPBE_PAGES_FROM_MULTIPLE_SOURCES
  • Remnants of a different document inside this fileHTPBE_RESIDUAL_DOCUMENT_STRUCTURE
  • Pages that went through different production routes in one documentHTPBE_MIXED_TOOLING_CLASSES
  • Image-based page content mixed into a digitally produced documentHTPBE_SCAN_IN_DIGITAL_DOC
  • Pages re-exported from an existing PDFHTPBE_REEXPORTED_THROUGH_OFFICE_SUITE
  • Page layout evidence of pages combined from separate documentsHTPBE_MIXED_PAGE_DIMENSIONS
  • Page template evidence of pages from another sourceHTPBE_TEMPLATE_PATTERN_BREAK
  • Document reconstructed as a new file rather than produced as the originalHTPBE_REBUILT_FROM_LOCAL_SOURCE
13

Content Stream Analysis

  • Editing traces within the document’s pagesHTPBE_CONTENT_STREAM_EDITING_MARKERS
  • Page drawing evidence consistent with editingHTPBE_DRAWING_OPS_INCONSISTENT
  • Document printed to a new PDF after its original creationHTPBE_PRINTED_OUT_OF_PDF_READER
  • Signs of text added over existing page contentHTPBE_TEXT_OVERLAY_ON_SCAN
  • Hidden text on the page consistent with an edit to visible textHTPBE_INVISIBLE_DUPLICATE_TEXT
  • Localised edits placed over the original page textHTPBE_CHARACTER_OVERLAY_EDIT
  • Individual characters that appear replaced after authoringHTPBE_GLYPH_LEVEL_EDIT
  • Font usage on a page that points to text added after authoringHTPBE_MIXED_FONT_EMBEDDING
  • Original fonts that appear partly replaced after authoringHTPBE_PARTIAL_FONT_REPLACEMENT
  • Annotations that appear merged into the page contentHTPBE_BURNED_IN_ANNOTATIONS
  • A form field showing signs of alterationHTPBE_WIDGET_APPEARANCE_MISMATCH
  • A redaction that did not fully conceal its contentHTPBE_INCOMPLETE_REDACTION
  • Signs that part of a page was replaced after creationHTPBE_PAGE_REGION_SUBSTITUTED
5

Image Forensics

  • Embedded image showing signs of having been edited and re-savedHTPBE_IMAGE_EDITED_AND_RESAVED
  • Document content converted to images after creationHTPBE_COLLAPSED_TO_RASTER
  • A page captured from a physical copy rather than the original fileHTPBE_PHYSICAL_SCAN_GEOMETRY
  • A scan origin that does not hold upHTPBE_FAKE_SCANNER_ORIGIN
  • Scan-like pages with signs of software renderingHTPBE_RENDERED_PSEUDO_SCAN
4

Structural Integrity

  • Internal file structure showing signs of tamperingHTPBE_NAVIGATION_TABLE_MISMATCH
  • File layout altered after the file was finalisedHTPBE_DECLARED_SIZE_MISMATCH
  • Unexplained data added to the file after it was finalisedHTPBE_TRAILING_BYTES_AFTER_EOF
  • An additional integrity finding whose method is not disclosedHTPBE_PROPRIETARY_SIGNAL

How it works

Three steps, under 3 seconds

1

Send a PDF URL

POST a publicly accessible URL to /api/v1/analyze. No file upload, no size limit for the API. You get back a check ID immediately.

2

8 forensic domains analyzed

All 63 checks run in parallel across metadata, structure, digital signatures, generator fingerprinting, document assembly, content streams, image forensics, and structural integrity.

3

Verdict + named markers

GET /api/v1/result/{id} for a structured verdict — intact, modified, or inconclusive — with every triggered finding named individually and confidence rated.

Example API response

What you get back

A bank statement with a removed digital signature and mismatched timestamps returns this. Each marker is a named, actionable forensic finding – not a score.

GET /api/v1/result/{id}
{
  "id": "9f3a2c1d-8b47-4e6f-a012-3d5e7f890123",
  "status": "modified",
  "modification_confidence": "certain",
  "modification_markers": [
    "HTPBE_SIGNATURE_REMOVED",
    "HTPBE_DATES_DISAGREE"
  ],
  "creator": "Adobe Acrobat Pro DC",
  "has_incremental_updates": true,
  "update_chain_length": 3,
  "xref_count": 4,
  "page_count": 12
}

Full schema and all marker descriptions in the API reference →

Close the structural gap your KYC stack leaves open

Start with welcome credits, no card required. Point the API at a PDF URL and read the verdict in seconds.

Close the Structural Gap — Start with Welcome CreditsRead the API Reference

Verdicts

Three possible outcomes

intact

No modification detected

No structural evidence of post-creation changes was found in the file.

Intact confirms the file was not modified. It does not guarantee the content is truthful – a document fabricated from scratch with false data can return intact.

inconclusive

Integrity couldn’t be determined

For some files the check cannot decide either way — it can’t confirm the document is unchanged, and it hasn’t found that it was changed.

For fraud teams: a missing flag here is not a clean result, and inconclusive is not by itself a judgment about the document. Weigh it against the document’s expected source, and for anything that matters, verify it with the issuer directly.

modified

Forensic evidence of tampering

One or more structural markers confirm post-creation modification. Confidence is either certain — reserved for the most unambiguous structural evidence, such as a removed signature or contradicting timestamps — or high for all other markers.

Regression testing

Every release is proved against several thousand forgeries first

Before any change to the algorithm ships, it runs against a regression corpus of several thousand synthetic PDFs built to cover every known method of document forgery — incremental-update edits, overlay patches, spliced page assemblies, template reuse, forged scans, and injected metadata among them.

A change is released only when it holds its verdict across the entire corpus. That is how a new rule can never quietly break an old one, and why the algorithm changelog moves forward without regressions.

Related

API DocumentationPricingFree PDF Metadata ViewerAlgorithm ChangelogService StatusStart Free – 5 Checks

Secure your workflow

Create your account – check PDFs on the web or with an API key, both ready on signup.
No sales call. Cancel any time.

Start Free – Close the Structural Fraud GapSee Pricing
Read API Docs →