Forensic check

HTPBE_RENDERED_PSEUDO_SCAN

Q: What does HTPBE_RENDERED_PSEUDO_SCAN mean?

HTPBE_RENDERED_PSEUDO_SCAN is a named finding in an HTPBE result: scan-like pages with signs of software rendering. It is returned in the modification_markers list of a modified result and belongs to the Image Forensics group of checks.

HTPBE_RENDERED_PSEUDO_SCAN appears on 2.3% of modified results in our corpus. A marker is evidence about the file, not a judgement about the person who sent it.

Back to all checks

Marker profile

Image Forensics

Scan-like pages with signs of software rendering.

Share of modified results

2.3%

Frequency rank

#15

Among the 56 markers seen in modified results

Certain confidence

14.8%

Of results with this marker rated certain rather than high

Fires alone

0.8%

Results where it is the only marker found

Marker profile

What HTPBE_RENDERED_PSEUDO_SCAN tells you

HTPBE_RENDERED_PSEUDO_SCAN is one of the named findings returned in modification_markers when a PDF is reported as modified. It belongs to the Image Forensics group of checks. These checks look at embedded images and scan-like pages for editing, re-saving or a capture origin that does not hold up.

On 0.8% of the modified results that carry HTPBE_RENDERED_PSEUDO_SCAN it is the only marker. A result with this marker carries 2.9 markers on average. It is most often found together with HTPBE_PHYSICAL_SCAN_GEOMETRY, on 94.2% of these results.

Example API response

How it appears in a result

When a PDF is reported as modified, HTPBE_RENDERED_PSEUDO_SCAN is listed in modification_markers next to the verdict and its confidence. Each marker is a named, actionable finding – not a score.

GET /api/v1/result/{id}

{
  "id": "9f3a2c1d-8b47-4e6f-a012-3d5e7f890123",
  "status": "modified",
  "modification_confidence": "high",
  "modification_markers": [
    "HTPBE_RENDERED_PSEUDO_SCAN"
  ],
  "creator": "Adobe Acrobat Pro DC",
  "has_incremental_updates": true,
  "page_count": 3
}

Full schema in the API reference →

Distributions

What ships alongside HTPBE_RENDERED_PSEUDO_SCAN

The tools, formats and document traits that appear on the modified results carrying this marker. Shares are of those results.

Common Producers

iLovePDF writes 9.5% of these results – and 3.4% of all modified results naming it carry this marker.

iLovePDF3.4% of its modified9.5%

Adobe Acrobat11.0% of its modified6.2%

macOS Print to PDF2.6% of its modified6.2%

Adobe Photoshop33.3% of its modified4.9%

iOS Print to PDF4.0% of its modified4.9%

jsPDF38.7% of its modified4.9%

PDFium5.3% of its modified4.9%

Microsoft Print to PDF9.5% of its modified4.1%

Common Creators

Adobe Acrobat is the Creator on 5.3% of these results.

Adobe Acrobat9.9% of its modified5.3%

PDFium4.9% of its modified4.9%

Photos72.7% of its modified3.3%

Scanner Canon33.3% of its modified2.5%

Scanner Xerox50.0% of its modified2.5%

Adobe Photoshop13.5% of its modified2.1%

ApeosPort-V C3375100.0% of its modified2.1%

Preview3.3% of its modified2.1%

Often found together with

HTPBE_PHYSICAL_SCAN_GEOMETRY sits next to HTPBE_RENDERED_PSEUDO_SCAN more often than any other marker.

HTPBE_PHYSICAL_SCAN_GEOMETRY94.2%

HTPBE_DATES_DISAGREE14.4%

HTPBE_IDENTITY_BLANKED14.0%

HTPBE_FAKE_SCANNER_ORIGIN13.6%

HTPBE_ONLINE_EDITOR_ORIGIN10.3%

HTPBE_MULTIPLE_REVISION_LAYERS8.2%

HTPBE_TOOL_VS_STRUCTURE_MISMATCH7.0%

HTPBE_METADATA_ONLY_REVISION4.5%

Document origin

Scanned49.8%

Consumer software23.9%

Unverifiable12.8%

Online editor10.3%

Unknown2.9%

Creator → Producer pairs

Adobe Acrobat → Adobe Acrobat4.9%

PDFium → PDFium4.9%

Photos → iOS Print to PDF2.9%

Scanner Canon → Scanner Canon2.5%

Scanner Xerox → Scanner Xerox2.5%

ApeosPort-V C3375 → ApeosPort-V C33752.1%

Preview → macOS Print to PDF2.1%

Adobe Photoshop → Adobe Photoshop1.6%

Detected origin software

macOS / iOS (Quartz)10.7%

iLovePDF9.5%

Adobe Photoshop5.3%

Microsoft Print to PDF4.1%

Xerox MFP2.5%

Adobe Scan1.2%

Confidence of the verdict

Certain14.8%

High85.2%

When these results were checked

May 20268.6%

June 202610.7%

July 202620.2%

August 202617.3%

September 202618.1%

October 202620.2%

November 20264.9%

Document length

1 page51.9%

2–5 pages33.3%

6–20 pages11.5%

21–100 pages3.3%

File size

Under 100 KB9.1%

100 KB – 1 MB65.0%

1 – 5 MB21.8%

Over 5 MB4.1%

PDF versions

PDF 1.733.3%

PDF 1.327.2%

PDF 1.418.1%

PDF 1.616.5%

PDF 1.52.9%

PDF 1.11.6%

Year the document says it was created

20211.2%

20221.2%

20241.2%

20251.2%

202666.3%

Long tail

Notable observations

Smaller cuts of the results carrying HTPBE_RENDERED_PSEUDO_SCAN – useful context, but treat each row as a single data point rather than a strong signal.

Digitally signed

Of files carry at least one digital signature

Saved revisions

8.2%

Of files contain earlier saved revisions

Embedded JavaScript

1.6%

Of files contain JavaScript code

Embedded files

1.6%

Of files have attachments inside

Avg pages per document

4.4

Markers per result

2.9

Average number of markers on these results

Related checks

Other Image Forensics checks

Checks from the same group. Each card links to its own reference page.

HTPBE_IMAGE_EDITED_AND_RESAVEDEmbedded image showing signs of having been edited and re-saved

Share of modified0.3%

HTPBE_COLLAPSED_TO_RASTERDocument content converted to images after creation

Share of modified0.4%

HTPBE_PHYSICAL_SCAN_GEOMETRYA page captured from a physical copy rather than the original file

Share of modified5.4%

Seen together94.2%

HTPBE_FAKE_SCANNER_ORIGINA scan origin that does not hold up

Share of modified0.8%

Seen together13.6%

FAQ

HTPBE_RENDERED_PSEUDO_SCAN: common questions

What does HTPBE_RENDERED_PSEUDO_SCAN mean?

HTPBE_RENDERED_PSEUDO_SCAN is a named finding in an HTPBE? result: scan-like pages with signs of software rendering. It is returned in the modification_markers list of a modified result and belongs to the Image Forensics group of checks.

Does HTPBE_RENDERED_PSEUDO_SCAN mean the document is fake?

No. A marker is evidence about the file, not a judgement about the person who sent it. It records that the file shows this pattern; it does not say why, and it does not assess what the document states. Read it together with the verdict and any other markers on the same result.

What should I do when a result contains HTPBE_RENDERED_PSEUDO_SCAN?

Ask the sender for the original file straight from the issuing system, or request a fresh copy from the issuer. Check whether the document went through a later step such as re-saving, merging or converting, and verify it with the issuer before relying on it for a decision.

How common is HTPBE_RENDERED_PSEUDO_SCAN?

HTPBE_RENDERED_PSEUDO_SCAN appears on 2.3% of the modified results in the HTPBE? corpus. The corpus consists of PDFs people chose to submit for checking, so it skews towards documents someone had a reason to doubt and is not a sample of all PDFs.

Where do I see HTPBE_RENDERED_PSEUDO_SCAN?

In the modification_markers list of the result returned by the HTPBE? API, and on the result page of a modified document. Other checks in the Image Forensics group are listed below on this page; all 63 checks are listed on the how-it-works page.

Secure your workflow

Create your account – check PDFs on the web or with an API key, both ready on signup.
No sales call. Cancel any time.

Start Free – Close the Structural Fraud Gap See Pricing

Read API Docs →