logo
Forensic check

HTPBE_IMPOSSIBLE_TIMESTAMP

HTPBE_IMPOSSIBLE_TIMESTAMP appears on 1.5% of modified results in our corpus. A marker is evidence about the file, not a judgement about the person who sent it.

Back to all checks
Marker profile

Metadata & Timestamps

Timestamp values that are physically impossible.

Share of modified results
1.5%
Frequency rank
#19
Among the 56 markers seen in modified results
Certain confidence
20.4%
Of results with this marker rated certain rather than high
Fires alone
40.1%
Results where it is the only marker found

Marker profile

What HTPBE_IMPOSSIBLE_TIMESTAMP tells you

HTPBE_IMPOSSIBLE_TIMESTAMP is one of the named findings returned in modification_markers when a PDF is reported as modified. It belongs to the Metadata & Timestamps group of checks. These checks compare the dates and descriptive properties recorded in a file with each other and with a plausible production history.

On 40.1% of the modified results that carry HTPBE_IMPOSSIBLE_TIMESTAMP it is the only marker. A result with this marker carries 2.2 markers on average. It is most often found together with HTPBE_TOOL_VS_STRUCTURE_MISMATCH, on 17.8% of these results.

Example API response

How it appears in a result

When a PDF is reported as modified, HTPBE_IMPOSSIBLE_TIMESTAMP is listed in modification_markers next to the verdict and its confidence. Each marker is a named, actionable finding – not a score.

GET /api/v1/result/{id}
{
  "id": "9f3a2c1d-8b47-4e6f-a012-3d5e7f890123",
  "status": "modified",
  "modification_confidence": "high",
  "modification_markers": [
    "HTPBE_IMPOSSIBLE_TIMESTAMP"
  ],
  "creator": "Adobe Acrobat Pro DC",
  "has_incremental_updates": true,
  "page_count": 3
}

Full schema in the API reference →

Distributions

What ships alongside HTPBE_IMPOSSIBLE_TIMESTAMP

The tools, formats and document traits that appear on the modified results carrying this marker. Shares are of those results.

Common Producers

PDFium writes 32.5% of these results – and 22.7% of all modified results naming it carry this marker.

PDFium22.7% of its modified32.5%
Master PDF Editor88.2% of its modified9.6%
TargetStream StreamEDS17.9% of its modified6.4%
Scanner Ricoh14.9% of its modified4.5%
WeasyPrint60.0% of its modified3.8%
jsPDF16.1% of its modified3.2%
Scanner HP83.3% of its modified3.2%
Scanner KONICA MINOLTA29.4% of its modified3.2%

Common Creators

PDFium is the Creator on 34.4% of these results.

PDFium22.0% of its modified34.4%
Master PDF Editor88.2% of its modified9.6%
Bank of America17.9% of its modified7.6%
Scanner Ricoh16.7% of its modified5.1%
Scanner HP4.0% of its modified3.2%
iText50.0% of its modified2.5%
PScript52.4% of its modified2.5%
Scanner KONICA MINOLTA33.3% of its modified2.5%

Often found together with

HTPBE_TOOL_VS_STRUCTURE_MISMATCH sits next to HTPBE_IMPOSSIBLE_TIMESTAMP more often than any other marker.

Document origin

Consumer software36.3%
Institutional32.5%
Scanned19.7%
Unknown10.8%

Creator → Producer pairs

PDFium → PDFium32.5%
Master PDF Editor → Master PDF Editor9.6%
Bank of America → TargetStream StreamEDS6.4%
Scanner Ricoh → Scanner Ricoh4.5%
Scanner HP → Scanner HP3.2%
iText → iOS Print to PDF2.5%
PScript5 → Acrobat Distiller2.5%
Scanner KONICA MINOLTA → Scanner KONICA MINOLTA2.5%

Detected origin software

Browser (Print to PDF)24.2%
macOS / iOS (Quartz)3.8%
Microsoft Print to PDF1.9%
Microsoft Word1.9%
RICOH MFP1.9%

Confidence of the verdict

Certain20.4%
High79.6%

When these results were checked

April 20267.0%
May 202612.7%
June 202610.2%
July 202615.9%
August 202610.2%
September 202628.7%
October 20269.6%
November 20265.7%

Document length

1 page40.8%
2–5 pages36.9%
6–20 pages19.1%
21–100 pages3.2%

File size

Under 100 KB35.0%
100 KB – 1 MB55.4%
1 – 5 MB8.9%
Over 5 MB0.6%

PDF versions

PDF 1.766.2%
PDF 1.414.6%
PDF 1.38.3%
PDF 1.55.7%
PDF 1.65.1%

Year the document says it was created

202692.4%

Long tail

Notable observations

Smaller cuts of the results carrying HTPBE_IMPOSSIBLE_TIMESTAMP – useful context, but treat each row as a single data point rather than a strong signal.

Digitally signed
0.6%

Of files carry at least one digital signature

Saved revisions
7.0%

Of files contain earlier saved revisions

Embedded JavaScript
0%

Of files contain JavaScript code

Embedded files
0%

Of files have attachments inside

Avg pages per document
4.5
Markers per result
2.2

Average number of markers on these results

Related checks

Other Metadata & Timestamps checks

Checks from the same group. Each card links to its own reference page.

HTPBE_DATES_DISAGREERecorded dates showing the document was changed after creation
Share of modified42.0%
Seen together16.6%
HTPBE_TIMESTAMP_LAYERS_DISAGREEInternal timestamp anomalies indicating a later change
Share of modified8.8%
HTPBE_IDENTITY_LAYERS_DISAGREEDocument properties indicating later alteration
Share of modified2.9%
HTPBE_INVALID_TIMEZONEDate information that is malformed
Share of modified0.1%
HTPBE_ANNOTATION_PREDATES_CREATIONAnnotation dates that do not fit the document’s timeline
Share of modified0.8%
HTPBE_UNLOCK_TOOL_RESIDUESigns that a document-unlocking or editing tool processed this file
Share of modified<0.1%
HTPBE_XMP_DATES_DESYNCEDMetadata timing indicating a later change
Share of modified0.5%
HTPBE_TIMEZONE_LAYERS_DISAGREETime-zone evidence of a later change
Share of modified<0.1%

FAQ

HTPBE_IMPOSSIBLE_TIMESTAMP: common questions

What does HTPBE_IMPOSSIBLE_TIMESTAMP mean?

HTPBE_IMPOSSIBLE_TIMESTAMP is a named finding in an HTPBE? result: timestamp values that are physically impossible. It is returned in the modification_markers list of a modified result and belongs to the Metadata & Timestamps group of checks.

Does HTPBE_IMPOSSIBLE_TIMESTAMP mean the document is fake?

No. A marker is evidence about the file, not a judgement about the person who sent it. It records that the file shows this pattern; it does not say why, and it does not assess what the document states. Read it together with the verdict and any other markers on the same result.

What should I do when a result contains HTPBE_IMPOSSIBLE_TIMESTAMP?

Ask the sender for the original file straight from the issuing system, or request a fresh copy from the issuer. Check whether the document went through a later step such as re-saving, merging or converting, and verify it with the issuer before relying on it for a decision.

How common is HTPBE_IMPOSSIBLE_TIMESTAMP?

HTPBE_IMPOSSIBLE_TIMESTAMP appears on 1.5% of the modified results in the HTPBE? corpus. The corpus consists of PDFs people chose to submit for checking, so it skews towards documents someone had a reason to doubt and is not a sample of all PDFs.

Where do I see HTPBE_IMPOSSIBLE_TIMESTAMP?

In the modification_markers list of the result returned by the HTPBE? API, and on the result page of a modified document. Other checks in the Metadata & Timestamps group are listed below on this page; all 63 checks are listed on the how-it-works page.

Secure your workflow

Create your account – check PDFs on the web or with an API key, both ready on signup.
No sales call. Cancel any time.

Start Free – Close the Structural Fraud GapSee Pricing
Read API Docs →