Published on · 7 min read · The Veritas-Doc team
What a PDF keeps of an edit
A PDF is not an image: it is a container that accumulates layers. Here are the four places where an edit often leaves a trace, and how to read them together.
1. The two fields that give away the toolchain
Every PDF carries two metadata fields that are too often confused. /Creator names the application that composed the document — a word processor, an invoicing tool. /Producer names the library that actually wrote it to disk.
When both fields belong to the same family, the chain is consistent. When a document announces “Microsoft Word” as /Creator and an online PDF editor as /Producer, it was reopened elsewhere after creation. This is the single most telling signal of the set.
That is still not a conclusion: compressing an oversized attachment with an online service produces exactly the same signature as a retouch.
2. The startxref markers count the rewrites
The PDF format allows changes to be appended to the end of a file without rewriting what precedes them: this is the incremental save. Each operation leaves an additional startxref marker.
A document generated once by a payroll system carries only one. Three markers mean three openings followed by a save — worth a question on a document supposed to come straight out of a system.
An electronic signature also adds an incremental save. The counter alone does not separate the two cases.
3. A white rectangle deletes nothing
It is the most common move: draw an opaque rectangle over an inconvenient line, then write something else next to it. On screen and in print, the line is gone.
Inside the file, it is not. The rectangle is a graphics object laid on top; the text stays in the content stream, at its original coordinates. You only need to ask the engine what that area contains to get it back.
That is the difference between saying “this area is covered” and showing what it covered. Veritas-Doc displays the recovered text at its exact position, with the extraction confidence figure.
4. Why a score, and why never a verdict
A tool that answers “clean” or “altered” with nothing else is unusable: two very different documents end up showing the same thing, and trust collapses at the first false positive.
Veritas-Doc starts from 100, then subtracts the weight of each reported signal. The report shows the full list, line by line, with what each one cost the score.
The tool stops there. Writing that a document is fraudulent is a legal qualification, and a false positive on a payslip can cost someone a home. The interface vocabulary therefore sticks to technical signs of modification, and the decision stays human.