logo
Forensic check

HTPBE_MULTIPLE_REVISION_LAYERS

HTPBE_MULTIPLE_REVISION_LAYERS appears on 21.5% of modified results in our corpus. A marker is evidence about the file, not a judgement about the person who sent it.

Back to all checks
Marker profile

Incremental Update History

Saved revisions showing the document was modified after creation.

Share of modified results
21.5%
Frequency rank
#2
Among the 56 markers seen in modified results
Certain confidence
58.6%
Of results with this marker rated certain rather than high
Fires alone
6.9%
Results where it is the only marker found

Marker profile

What HTPBE_MULTIPLE_REVISION_LAYERS tells you

HTPBE_MULTIPLE_REVISION_LAYERS is one of the named findings returned in modification_markers when a PDF is reported as modified. It belongs to the Incremental Update History group of checks. These checks look at the saved revision history of a file and what it says about changes after the original was produced.

On 6.9% of the modified results that carry HTPBE_MULTIPLE_REVISION_LAYERS it is the only marker. A result with this marker carries 3.3 markers on average. It is most often found together with HTPBE_DATES_DISAGREE, on 56.2% of these results.

Example API response

How it appears in a result

When a PDF is reported as modified, HTPBE_MULTIPLE_REVISION_LAYERS is listed in modification_markers next to the verdict and its confidence. Each marker is a named, actionable finding – not a score.

GET /api/v1/result/{id}
{
  "id": "9f3a2c1d-8b47-4e6f-a012-3d5e7f890123",
  "status": "modified",
  "modification_confidence": "high",
  "modification_markers": [
    "HTPBE_MULTIPLE_REVISION_LAYERS"
  ],
  "creator": "Adobe Acrobat Pro DC",
  "has_incremental_updates": true,
  "page_count": 3
}

Full schema in the API reference →

Distributions

What ships alongside HTPBE_MULTIPLE_REVISION_LAYERS

The tools, formats and document traits that appear on the modified results carrying this marker. Shares are of those results.

Common Producers

Microsoft Word writes 15.8% of these results – and 47.3% of all modified results naming it carry this marker.

Microsoft Word47.3% of its modified15.8%
iText30.3% of its modified12.9%
macOS Print to PDF42.1% of its modified10.9%
Acrobat Distiller80.5% of its modified7.0%
Scrive AB100.0% of its modified3.9%
Prince82.8% of its modified2.1%
Acrobat Sign50.0% of its modified1.9%
Adobe Express89.4% of its modified1.9%

Common Creators

Microsoft Word is the Creator on 21.6% of these results.

Microsoft Word43.8% of its modified21.6%
PScript583.8% of its modified6.2%
ActiveReports37.0% of its modified5.6%
PDF Driver100.0% of its modified3.9%
Adobe Express89.4% of its modified1.9%
Acrobat PDFMaker49.1% of its modified1.2%
Adobe Acrobat17.6% of its modified1.0%
JasperReports17.2% of its modified1.0%

Often found together with

HTPBE_DATES_DISAGREE sits next to HTPBE_MULTIPLE_REVISION_LAYERS more often than any other marker.

Document origin

Consumer software37.9%
Institutional36.4%
Unknown18.9%
Scanned2.5%
Online editor1.3%
Analysis incomplete0.4%
Unverifiable0.2%

Creator → Producer pairs

Microsoft Word → Microsoft Word15.7%
PScript5 → Acrobat Distiller6.2%
ActiveReports → macOS Print to PDF5.6%
PDF Driver → Scrive AB3.9%
Microsoft Word → macOS Print to PDF2.6%
Microsoft Word → Acrobat Sign1.9%
Adobe Express → Adobe Express1.9%
Adobe Acrobat → Adobe Acrobat0.9%

Detected origin software

Microsoft Word18.2%
macOS / iOS (Quartz)11.9%
Adobe Express1.9%
Browser (Print to PDF)1.1%
Microsoft Print to PDF1.0%
Google Chrome0.7%
iLovePDF0.6%
LibreOffice0.5%

Confidence of the verdict

Certain54.6%
High38.6%

When these results were checked

February 20261.8%
March 20264.9%
April 202670.2%
May 20264.5%
June 20262.0%
July 20263.0%
August 20263.1%
September 20263.4%
October 20265.8%
November 20261.4%

Document length

1 page39.2%
2–5 pages19.0%
6–20 pages27.6%
21–100 pages7.3%

File size

Under 100 KB11.1%
100 KB – 1 MB76.7%
1 – 5 MB9.2%
Over 5 MB3.1%

PDF versions

PDF 1.738.7%
PDF 1.519.8%
PDF 1.312.4%
PDF 1.412.0%
PDF 1.69.9%
PDF 2.00.2%
PDF unknown0.1%

Year the document says it was created

20162.1%
20227.3%
20234.0%
20247.5%
20252.9%
202656.0%

Long tail

Notable observations

Smaller cuts of the results carrying HTPBE_MULTIPLE_REVISION_LAYERS – useful context, but treat each row as a single data point rather than a strong signal.

Digitally signed
11.6%

Of files carry at least one digital signature

Saved revisions
93.2%

Of files contain earlier saved revisions

Embedded JavaScript
4.0%

Of files contain JavaScript code

Embedded files
5.4%

Of files have attachments inside

Avg pages per document
6.3
Markers per result
3.3

Average number of markers on these results

Related checks

Other Incremental Update History checks

Checks from the same group. Each card links to its own reference page.

HTPBE_METADATA_ONLY_REVISIONA post-creation revision consistent with targeted alteration
Share of modified7.1%
Seen together33.1%
HTPBE_FLATTENED_EDIT_HISTORYSigns the file was rebuilt after its original production
Share of modified1.3%

FAQ

HTPBE_MULTIPLE_REVISION_LAYERS: common questions

What does HTPBE_MULTIPLE_REVISION_LAYERS mean?

HTPBE_MULTIPLE_REVISION_LAYERS is a named finding in an HTPBE? result: saved revisions showing the document was modified after creation. It is returned in the modification_markers list of a modified result and belongs to the Incremental Update History group of checks.

Does HTPBE_MULTIPLE_REVISION_LAYERS mean the document is fake?

No. A marker is evidence about the file, not a judgement about the person who sent it. It records that the file shows this pattern; it does not say why, and it does not assess what the document states. Read it together with the verdict and any other markers on the same result.

What should I do when a result contains HTPBE_MULTIPLE_REVISION_LAYERS?

Ask the sender for the original file straight from the issuing system, or request a fresh copy from the issuer. Check whether the document went through a later step such as re-saving, merging or converting, and verify it with the issuer before relying on it for a decision.

How common is HTPBE_MULTIPLE_REVISION_LAYERS?

HTPBE_MULTIPLE_REVISION_LAYERS appears on 21.5% of the modified results in the HTPBE? corpus. The corpus consists of PDFs people chose to submit for checking, so it skews towards documents someone had a reason to doubt and is not a sample of all PDFs.

Where do I see HTPBE_MULTIPLE_REVISION_LAYERS?

In the modification_markers list of the result returned by the HTPBE? API, and on the result page of a modified document. Other checks in the Incremental Update History group are listed below on this page; all 63 checks are listed on the how-it-works page.

Secure your workflow

Create your account – check PDFs on the web or with an API key, both ready on signup.
No sales call. Cancel any time.

Start Free – Close the Structural Fraud GapSee Pricing
Read API Docs →