How to check if PDF was modified

Question

I have a PDF generated by 3rd party system. Using PDF editor or els software I have modified it.
Is it possible to detect if PDF file was modified, without original file?

I will add some more details.

There is no encryption and no signature features.

Document is created by IT system. User receives document and modifies it.

Is it possible to track that change somehow?

I thought that all these applications leaves some data in PDF header or somewhere encoded inside file and it is possible to check it. However properties showed by windows explorer shows nothing... so I was interested if there is something smarter than viewing properties/header in explorer.

Answer 1

The problem with this is that just opening the PDF on a Mac in Preview and hitting Command-S to save the file will replace both the Creation and Modification date to match the current date/time. So even the creation date will be wrong. Even novice users can unknowingly do this, so if you're trying to track someone who may be purposefully modifying the document, it may lead to a false positive.

What you're asking is just too easy to spoof and fool unfortunately.

Answer 2

If you're using Ubuntu linux 18.04 and using Document Viewer then, you can

• click on File options (3 vertical line ellipsis)
• click on Properties...
• look for Created / Modified fields in the Properties pop up

Beware: A sufficiently knowledgeable user can manipulate the PDF contents without changing the Created and Modified time stamps in the PDF metadata and the file system.

Answer 3

If the tool used to modify the PDF is working according to the PDF spec then in the Info dictionary it should update ModDate but leave CreationDate alone. You may also see some non-zero generation numbers on the objects although it is just as possible that all the objects have been regenerated and will therefore be generation 0. The trial version of CosEdit will allow you to look at these 2 items.

If however the tool has been used to intentionally modify the PDF without leaving a trace then they would be spoofing those bits of data so they won't help you.