logo
Forensic check

HTPBE_TIMESTAMP_LAYERS_DISAGREE

HTPBE_TIMESTAMP_LAYERS_DISAGREE appears on 8.8% of modified results in our corpus. A marker is evidence about the file, not a judgement about the person who sent it.

Back to all checks
Marker profile

Metadata & Timestamps

Internal timestamp anomalies indicating a later change.

Share of modified results
8.8%
Frequency rank
#8
Among the 56 markers seen in modified results
Certain confidence
61.5%
Of results with this marker rated certain rather than high
Fires alone
6.3%
Results where it is the only marker found

Marker profile

What HTPBE_TIMESTAMP_LAYERS_DISAGREE tells you

HTPBE_TIMESTAMP_LAYERS_DISAGREE is one of the named findings returned in modification_markers when a PDF is reported as modified. It belongs to the Metadata & Timestamps group of checks. These checks compare the dates and descriptive properties recorded in a file with each other and with a plausible production history.

On 6.3% of the modified results that carry HTPBE_TIMESTAMP_LAYERS_DISAGREE it is the only marker. A result with this marker carries 2.9 markers on average. It is most often found together with HTPBE_DATES_DISAGREE, on 60.6% of these results.

Example API response

How it appears in a result

When a PDF is reported as modified, HTPBE_TIMESTAMP_LAYERS_DISAGREE is listed in modification_markers next to the verdict and its confidence. Each marker is a named, actionable finding – not a score.

GET /api/v1/result/{id}
{
  "id": "9f3a2c1d-8b47-4e6f-a012-3d5e7f890123",
  "status": "modified",
  "modification_confidence": "high",
  "modification_markers": [
    "HTPBE_TIMESTAMP_LAYERS_DISAGREE"
  ],
  "creator": "Adobe Acrobat Pro DC",
  "has_incremental_updates": true,
  "page_count": 3
}

Full schema in the API reference →

Distributions

What ships alongside HTPBE_TIMESTAMP_LAYERS_DISAGREE

The tools, formats and document traits that appear on the modified results carrying this marker. Shares are of those results.

Common Producers

iText writes 35.1% of these results – and 33.8% of all modified results naming it carry this marker.

iText33.8% of its modified35.1%
mPDF93.5% of its modified12.5%
Microsoft Word2.7% of its modified2.2%
iOS Print to PDF5.0% of its modified1.6%
macOS Print to PDF2.4% of its modified1.5%
pdf-lib17.1% of its modified1.3%
Acrobat Distiller5.1% of its modified1.1%
Adobe PDF Library3.4% of its modified1.1%

Common Creators

Altiuz Reports is the Creator on 39.2% of these results.

Altiuz Reports100.0% of its modified39.2%
Adobe Illustrator35.0% of its modified13.5%
Microsoft Reporting Services17.9% of its modified6.7%
Microsoft Word4.1% of its modified4.9%
Acrobat PDFMaker22.6% of its modified1.3%
Canva16.7% of its modified1.1%
PDFium4.1% of its modified1.1%
Form X_65_80 EN30.4% of its modified0.8%

Often found together with

HTPBE_DATES_DISAGREE sits next to HTPBE_TIMESTAMP_LAYERS_DISAGREE more often than any other marker.

Document origin

Institutional73.5%
Consumer software25.1%
Scanned0.7%
Unknown0.5%

Creator → Producer pairs

Altiuz Reports → iText25.8%
Adobe Illustrator → mPDF12.4%
Microsoft Word → Microsoft Word2.2%
PDFium → PDFium0.9%
Form X_65_80 EN → SAP NetWeaver 7500.8%
Acrobat PDFMaker → Adobe PDF Library0.7%
Adobe Illustrator → iText0.7%
Microsoft Word → macOS Print to PDF0.7%

Detected origin software

Adobe Illustrator13.1%
Microsoft Word4.9%
macOS / iOS (Quartz)2.2%
Browser (Print to PDF)1.6%
Microsoft Excel0.7%
Canva0.5%
Adobe Acrobat PDFMaker (Office)0.4%
Adobe Photoshop0.4%

Confidence of the verdict

Certain60.0%
High37.6%

When these results were checked

March 20262.4%
April 202678.1%
May 20264.4%
June 20262.7%
July 20262.1%
August 20262.7%
September 20264.0%
October 20262.6%
November 20261.0%

Document length

1 page63.3%
2–5 pages29.9%
6–20 pages3.1%
21–100 pages1.3%

File size

Under 100 KB56.9%
100 KB – 1 MB38.8%
1 – 5 MB4.2%
Over 5 MB0.1%

PDF versions

PDF 1.536.1%
PDF 1.423.2%
PDF 1.719.4%
PDF 1.314.8%
PDF 1.64.0%

Year the document says it was created

20140.3%
20210.4%
20232.3%
202413.4%
20253.9%
202677.8%

Long tail

Notable observations

Smaller cuts of the results carrying HTPBE_TIMESTAMP_LAYERS_DISAGREE – useful context, but treat each row as a single data point rather than a strong signal.

Digitally signed
2.2%

Of files carry at least one digital signature

Saved revisions
17.0%

Of files contain earlier saved revisions

Embedded JavaScript
0.1%

Of files contain JavaScript code

Embedded files
0.4%

Of files have attachments inside

Avg pages per document
2.3
Markers per result
2.9

Average number of markers on these results

Related checks

Other Metadata & Timestamps checks

Checks from the same group. Each card links to its own reference page.

HTPBE_DATES_DISAGREERecorded dates showing the document was changed after creation
Share of modified42.0%
Seen together60.6%
HTPBE_IDENTITY_LAYERS_DISAGREEDocument properties indicating later alteration
Share of modified2.9%
Seen together15.3%
HTPBE_IMPOSSIBLE_TIMESTAMPTimestamp values that are physically impossible
Share of modified1.5%
HTPBE_INVALID_TIMEZONEDate information that is malformed
Share of modified0.1%
HTPBE_ANNOTATION_PREDATES_CREATIONAnnotation dates that do not fit the document’s timeline
Share of modified0.8%
HTPBE_UNLOCK_TOOL_RESIDUESigns that a document-unlocking or editing tool processed this file
Share of modified<0.1%
HTPBE_XMP_DATES_DESYNCEDMetadata timing indicating a later change
Share of modified0.5%
HTPBE_TIMEZONE_LAYERS_DISAGREETime-zone evidence of a later change
Share of modified<0.1%

FAQ

HTPBE_TIMESTAMP_LAYERS_DISAGREE: common questions

What does HTPBE_TIMESTAMP_LAYERS_DISAGREE mean?

HTPBE_TIMESTAMP_LAYERS_DISAGREE is a named finding in an HTPBE? result: internal timestamp anomalies indicating a later change. It is returned in the modification_markers list of a modified result and belongs to the Metadata & Timestamps group of checks.

Does HTPBE_TIMESTAMP_LAYERS_DISAGREE mean the document is fake?

No. A marker is evidence about the file, not a judgement about the person who sent it. It records that the file shows this pattern; it does not say why, and it does not assess what the document states. Read it together with the verdict and any other markers on the same result.

What should I do when a result contains HTPBE_TIMESTAMP_LAYERS_DISAGREE?

Ask the sender for the original file straight from the issuing system, or request a fresh copy from the issuer. Check whether the document went through a later step such as re-saving, merging or converting, and verify it with the issuer before relying on it for a decision.

How common is HTPBE_TIMESTAMP_LAYERS_DISAGREE?

HTPBE_TIMESTAMP_LAYERS_DISAGREE appears on 8.8% of the modified results in the HTPBE? corpus. The corpus consists of PDFs people chose to submit for checking, so it skews towards documents someone had a reason to doubt and is not a sample of all PDFs.

Where do I see HTPBE_TIMESTAMP_LAYERS_DISAGREE?

In the modification_markers list of the result returned by the HTPBE? API, and on the result page of a modified document. Other checks in the Metadata & Timestamps group are listed below on this page; all 63 checks are listed on the how-it-works page.

Secure your workflow

Create your account – check PDFs on the web or with an API key, both ready on signup.
No sales call. Cancel any time.

Start Free – Close the Structural Fraud GapSee Pricing
Read API Docs →