Blog

PDF forensics: what we check in the MVP

Methodology · 13 Jan 2026 · by CanonProof Team

PDF forensics: what we check in the MVP

PDF manipulation is often invisible to humans: incremental updates, object rewrites, and image re-saves can all change meaning while keeping the document “looking” identical.

Signals we extract

  • Incremental update chains (multiple revisions)
  • XRef repairs and rebuild artefacts
  • Image re-encoding ladders (e.g., copy-paste flattening)
  • Metadata plausibility (timestamps, producers, tools)

When evidence is weak or conflicting, CanonProof may return INDETERMINATE — with an explanation of what limited confidence.