logo
Forensic check

HTPBE_CONTENT_STREAM_EDITING_MARKERS

HTPBE_CONTENT_STREAM_EDITING_MARKERS appears on 10.7% of modified results in our corpus. A marker is evidence about the file, not a judgement about the person who sent it.

Back to all checks
Marker profile

Content Stream Analysis

Editing traces within the document’s pages.

Share of modified results
10.7%
Frequency rank
#6
Among the 56 markers seen in modified results
Certain confidence
71.8%
Of results with this marker rated certain rather than high
Fires alone
13.5%
Results where it is the only marker found

Marker profile

What HTPBE_CONTENT_STREAM_EDITING_MARKERS tells you

HTPBE_CONTENT_STREAM_EDITING_MARKERS is one of the named findings returned in modification_markers when a PDF is reported as modified. It belongs to the Content Stream Analysis group of checks. These checks look at the content of the pages themselves for signs of edits made after the document was authored.

On 13.5% of the modified results that carry HTPBE_CONTENT_STREAM_EDITING_MARKERS it is the only marker. A result with this marker carries 2.7 markers on average. It is most often found together with HTPBE_DATES_DISAGREE, on 69.1% of these results.

Example API response

How it appears in a result

When a PDF is reported as modified, HTPBE_CONTENT_STREAM_EDITING_MARKERS is listed in modification_markers next to the verdict and its confidence. Each marker is a named, actionable finding – not a score.

GET /api/v1/result/{id}
{
  "id": "9f3a2c1d-8b47-4e6f-a012-3d5e7f890123",
  "status": "modified",
  "modification_confidence": "high",
  "modification_markers": [
    "HTPBE_CONTENT_STREAM_EDITING_MARKERS"
  ],
  "creator": "Adobe Acrobat Pro DC",
  "has_incremental_updates": true,
  "page_count": 3
}

Full schema in the API reference →

Distributions

What ships alongside HTPBE_CONTENT_STREAM_EDITING_MARKERS

The tools, formats and document traits that appear on the modified results carrying this marker. Shares are of those results.

Common Producers

Microsoft Word writes 32.3% of these results – and 47.9% of all modified results naming it carry this marker.

Microsoft Word47.9% of its modified32.3%
Adobe Acrobat55.1% of its modified6.7%
iText5.7% of its modified4.9%
Prince74.1% of its modified3.9%
Adobe Express89.4% of its modified3.8%
TargetStream StreamEDS42.9% of its modified2.2%
Apache FOP14.2% of its modified1.5%
PDFium6.2% of its modified1.3%

Common Creators

Microsoft Word is the Creator on 32.4% of these results.

Microsoft Word32.6% of its modified32.4%
Adobe Acrobat51.1% of its modified6.0%
Quadient69.6% of its modified4.9%
Adobe Express89.4% of its modified3.8%
JasperReports22.7% of its modified2.6%
Bank of America40.3% of its modified2.4%
Apache FOP12.6% of its modified1.4%
PDFium5.7% of its modified1.3%

Often found together with

HTPBE_DATES_DISAGREE sits next to HTPBE_CONTENT_STREAM_EDITING_MARKERS more often than any other marker.

Document origin

Consumer software43.9%
Institutional42.9%
Unknown9.1%
Online editor2.2%
Scanned1.7%

Creator → Producer pairs

Microsoft Word → Microsoft Word32.3%
Adobe Acrobat → Adobe Acrobat6.0%
Adobe Express → Adobe Express3.8%
Bank of America → TargetStream StreamEDS2.2%
Apache FOP → Apache FOP1.4%
PDFium → PDFium1.3%
Chrome (Print to PDF) → Skia/PDF0.8%
pdf-lib → pdf-lib0.7%

Detected origin software

Microsoft Word32.3%
Adobe Express3.8%
Browser (Print to PDF)1.7%
Free HTML-to-PDF renderer1.7%
macOS / iOS (Quartz)1.7%
iLovePDF0.9%
Google Chrome0.8%
Microsoft Print to PDF0.8%

Confidence of the verdict

Certain71.8%
High28.2%

When these results were checked

April 202657.0%
May 202610.2%
June 20262.9%
July 20268.4%
August 20267.7%
September 20265.1%
October 20265.9%
November 20262.8%

Document length

1 page38.5%
2–5 pages48.9%
6–20 pages10.9%
21–100 pages1.7%
100+ pages0.1%

File size

Under 100 KB9.5%
100 KB – 1 MB83.6%
1 – 5 MB6.9%

PDF versions

PDF 1.755.5%
PDF 1.625.7%
PDF 1.59.6%
PDF 1.46.1%
PDF 1.32.2%
PDF 2.00.8%

Year the document says it was created

20190.5%
20224.4%
202333.2%
20241.7%
20252.1%
202648.9%

Long tail

Notable observations

Smaller cuts of the results carrying HTPBE_CONTENT_STREAM_EDITING_MARKERS – useful context, but treat each row as a single data point rather than a strong signal.

Digitally signed
32.5%

Of files carry at least one digital signature

Saved revisions
41.9%

Of files contain earlier saved revisions

Embedded JavaScript
0.3%

Of files contain JavaScript code

Embedded files
0.7%

Of files have attachments inside

Avg pages per document
3.1
Markers per result
2.7

Average number of markers on these results

Related checks

Other Content Stream Analysis checks

Checks from the same group. Each card links to its own reference page.

HTPBE_DRAWING_OPS_INCONSISTENTPage drawing evidence consistent with editing
Share of modified2.3%
HTPBE_PRINTED_OUT_OF_PDF_READERDocument printed to a new PDF after its original creationHTPBE_TEXT_OVERLAY_ON_SCANSigns of text added over existing page content
Share of modified1.0%
HTPBE_INVISIBLE_DUPLICATE_TEXTHidden text on the page that does not add up
Share of modified0.1%
HTPBE_CHARACTER_OVERLAY_EDITLocalised edits placed over the original page text
Share of modified0.3%
HTPBE_GLYPH_LEVEL_EDITIndividual characters that appear replaced after authoring
Share of modified0.2%
HTPBE_MIXED_FONT_EMBEDDINGFont usage on a page that points to text added after authoring
Share of modified0.1%
HTPBE_PARTIAL_FONT_REPLACEMENTOriginal fonts that appear partly replaced after authoring
Share of modified0.8%
HTPBE_BURNED_IN_ANNOTATIONSAnnotations that appear merged into the page content
Share of modified<0.1%
HTPBE_WIDGET_APPEARANCE_MISMATCHA form field showing signs of alteration
Share of modified<0.1%
HTPBE_INCOMPLETE_REDACTIONA redaction that did not fully conceal its content
Share of modified0.2%
HTPBE_PAGE_REGION_SUBSTITUTEDSigns that part of a page was replaced after creation
Share of modified<0.1%

FAQ

HTPBE_CONTENT_STREAM_EDITING_MARKERS: common questions

What does HTPBE_CONTENT_STREAM_EDITING_MARKERS mean?

HTPBE_CONTENT_STREAM_EDITING_MARKERS is a named finding in an HTPBE? result: editing traces within the document’s pages. It is returned in the modification_markers list of a modified result and belongs to the Content Stream Analysis group of checks.

Does HTPBE_CONTENT_STREAM_EDITING_MARKERS mean the document is fake?

No. A marker is evidence about the file, not a judgement about the person who sent it. It records that the file shows this pattern; it does not say why, and it does not assess what the document states. Read it together with the verdict and any other markers on the same result.

What should I do when a result contains HTPBE_CONTENT_STREAM_EDITING_MARKERS?

Ask the sender for the original file straight from the issuing system, or request a fresh copy from the issuer. Check whether the document went through a later step such as re-saving, merging or converting, and verify it with the issuer before relying on it for a decision.

How common is HTPBE_CONTENT_STREAM_EDITING_MARKERS?

HTPBE_CONTENT_STREAM_EDITING_MARKERS appears on 10.7% of the modified results in the HTPBE? corpus. The corpus consists of PDFs people chose to submit for checking, so it skews towards documents someone had a reason to doubt and is not a sample of all PDFs.

Where do I see HTPBE_CONTENT_STREAM_EDITING_MARKERS?

In the modification_markers list of the result returned by the HTPBE? API, and on the result page of a modified document. Other checks in the Content Stream Analysis group are listed below on this page; all 63 checks are listed on the how-it-works page.

Secure your workflow

Create your account – check PDFs on the web or with an API key, both ready on signup.
No sales call. Cancel any time.

Start Free – Close the Structural Fraud GapSee Pricing
Read API Docs →