Detect Tampered PDFs in Python Without Original

The Challenge of Verifying PDF Authenticity

A PDF arrives – it could be a critical financial document, a legal contract, or an important application. You need to trust its contents. The problem: you only have this single file. There's no pristine original stored elsewhere to cross-reference. This is a common scenario for developers processing incoming documents, where the integrity of the data is paramount.

The conventional wisdom often states that without the original document, verifying a PDF's authenticity is impossible. This is only partially true. PDFs are complex structures that embed a surprising amount of metadata and internal logic. These internal signals can reveal if a document has been altered after its initial creation. This article explores how to leverage Python libraries like pypdf and pikepdf to analyze these internal clues and detect tampering, even when you don't have the original file.

Understanding PDF Structure for Tamper Detection

To detect tampering, we must first understand how a PDF is structured and what information it holds internally. A PDF file is not a simple linear document; it's a database-like structure containing objects. These objects can include text, images, fonts, and crucially, metadata. When a PDF is edited, these objects can be modified, added, or deleted. The key is to identify inconsistencies or anachronisms within these embedded elements.

Several key areas within a PDF's internal structure provide evidence of its history:

• Creation and Modification Dates: PDFs can store dates related to their creation and last modification. While these can be forged, discrepancies between them, or their presence at all, can be telling.
• Object Streams: PDFs use object streams to compress and organize their content. The way these streams are structured and the order of objects can sometimes reveal editing.
• Internal References: Objects within a PDF reference each other. If these references become broken or point to unexpected places due to edits, it can indicate tampering.
• Font Embeddings: When fonts are embedded, they are part of the PDF. Changes to text might require changes to font references or the font data itself, which can leave traces.
• XMP Metadata: Extensible Metadata Platform (XMP) is often used to store detailed metadata, including author, creation date, and modification history. This can be a rich source of information, but it's also susceptible to manipulation.

The core idea is that a legitimate, untouched PDF will have internal consistency. An edited PDF might show signs of a hurried or incomplete modification, leaving behind digital fingerprints.

Leveraging Python Libraries: pypdf and pikepdf

Python offers powerful libraries to parse and manipulate PDF files. pypdf (a fork of the popular PyPDF2) and pikepdf are excellent choices for this task. While pypdf is generally good for basic operations and metadata extraction, pikepdf offers deeper access to the PDF's internal object structure, making it more suitable for advanced analysis.

Using pypdf for Basic Checks

pypdf can provide a good starting point by extracting basic metadata. You can access information like the document’s title, author, and importantly, the creation and modification dates if they are present.

Consider a scenario where a PDF claims to be created in 2023, but its modification date is in 2022. This is an immediate red flag. While dates can be altered, such obvious contradictions are hard to conceal.

Here's a simplified example of how you might use pypdf:

from pypdf import PdfReader

def check_pdf_metadata(file_path):
    try:
        reader = PdfReader(file_path)
        info = reader.metadata
        if info:
            print(f"Creation Date: {info.creation_date}")
            print(f"Modification Date: {info.modification_date}")
            # Further checks can be added here based on expected document properties
        else:
            print("No metadata found.")
    except Exception as e:
        print(f"Error reading PDF: {e}")

# Example usage:
# check_pdf_metadata("path/to/your/document.pdf")

However, relying solely on metadata is insufficient. These fields are easily manipulated by many PDF editing tools. A more robust approach involves inspecting the PDF's internal object structure.

Deep Dive with pikepdf

pikepdf provides a more granular view of the PDF structure. It treats the PDF as a collection of objects, allowing you to traverse the object tree and inspect individual elements. This is where you can find more subtle signs of tampering.

One technique is to examine the /Contents object, which typically holds the page content streams. If a PDF has been edited, the content stream might be altered or replaced in ways that differ from how a standard PDF writer would generate it. pikepdf allows you to access and analyze these streams.

Another powerful feature of pikepdf is its ability to detect inconsistencies in the PDF’s internal cross-reference table (xref) and trailer dictionary. A valid PDF has a coherent structure where objects are correctly indexed and referenced. Tampering can corrupt this structure.

Consider the PDF structure like a city map. The xref table is like the index of streets, and the trailer points to the main districts. If you edit a building (an object) without updating the street index or the district map, your map becomes inconsistent. pikepdf helps you spot these map inconsistencies.

Here's how you might start inspecting objects with pikepdf:

import pikepdf

def inspect_pdf_objects(file_path):
    try:
        with pikepdf.Pdf.open(file_path) as pdf:
            # Access the trailer dictionary, which contains pointers to key objects
            trailer = pdf.trailer
            print(f"Root object: {trailer.root}")
            print(f"Info object: {trailer.info}")

            # Iterate through pages and their content streams
            for i, page in enumerate(pdf.pages):
                print(f"Page {i+1} content stream analysis...")
                # Accessing raw content might require deeper object inspection
                # For example, looking for specific PDF operators or structures
                # that might indicate manual editing.

            # Advanced: Check for object stream integrity or inconsistencies
            # This is where more sophisticated tamper detection logic would live.

    except pikepdf.PasswordError:
        print("PDF is password protected.")
    except Exception as e:
        print(f"Error reading PDF with pikepdf: {e}")

# Example usage:
# inspect_pdf_objects("path/to/your/document.pdf")

What Constitutes Tampering?

Detecting tampering isn't about finding any change, but about identifying changes that violate the expected integrity of the document. This can include:

• Anomalous object creation/modification times: If a tool adds a new object, it might stamp it with the current time. If this time is wildly out of sync with the document's purported creation date, it's suspicious.
• Unusual object ordering: Standard PDF writers tend to create objects in a logical sequence. Edits might disrupt this sequence, placing new objects in unexpected parts of the file.
• Inconsistent internal references: A PDF relies heavily on internal pointers. If editing breaks these pointers, the file can become structurally unsound, even if it appears to render correctly.
• Presence of editing artifacts: Some PDF editors leave specific markers or structures that can be identified.
• Mismatched metadata: As mentioned, creator vs. modification dates are a start, but also check author information, software used to create/edit, etc.

The surprising detail here is not that PDFs can be tampered with, but that the evidence often remains embedded within the file itself, waiting to be deciphered. It's like finding a fingerprint on a document that was supposedly handled with gloves.

The Limitations and Future

It's crucial to acknowledge the limitations. Sophisticated attackers can attempt to clean up their edits, forging metadata and carefully reconstructing object structures to appear legitimate. No detection method is foolproof. The goal is to raise the bar for tampering and detect common, less sophisticated modifications.

Furthermore, the definition of