Deep PDF Tampering Forensic Analysis
Budget: £20 – £250 GBP
I’m in possession of a PDF witness statement and must prove—beyond a basic metadata scrape—that it was modified after 14 September 2025 and 20th October 2025. I‘m looking for an analyst who already works with tools such as pdf-parser.py, pdfid.py, PyPDF2 or pikepdf, qpdf --check, ExifTool-PDF modules, dedicated PDF Forensics Suites and hex editors so the investigation reaches object-stream level, not just the info dictionary.
Scope of the examination
• Internal object structure: locate and decode every indirect object, xref stream and incremental update chain.
• Digital signatures: verify integrity, time-stamps and any post-sign alteration markers.
• Embedded images & content: extract, hash and time-line any hidden or replaced resources.
• Incremental updates & XMP: enumerate revisions, compare object offsets and flag hidden metadata or deleted streams.
• Hex-level object changes: provide byte-level evidence showing where the file diverges from its pre-14/09/2025 state.
Deliverables
1. A concise forensic report (PDF/Word) explaining methodology, tool versions, findings and conclusions on whether edits occurred after the specified date.
2. Annotated output logs and screenshots from the tools above, clearly cross-referenced in the report.
3. The cleaned working copies you generated (no personal data removed from the original).
4. An executive-style summary I can forward to legal counsel.
The job is complete when the report convincingly shows either clear evidence of post-14 Sept 2025 and 20-October-2025 alteration or, if none exists, a defensible explanation of why the document remains unchanged.
Scope of the examination
• Internal object structure: locate and decode every indirect object, xref stream and incremental update chain.
• Digital signatures: verify integrity, time-stamps and any post-sign alteration markers.
• Embedded images & content: extract, hash and time-line any hidden or replaced resources.
• Incremental updates & XMP: enumerate revisions, compare object offsets and flag hidden metadata or deleted streams.
• Hex-level object changes: provide byte-level evidence showing where the file diverges from its pre-14/09/2025 state.
Deliverables
1. A concise forensic report (PDF/Word) explaining methodology, tool versions, findings and conclusions on whether edits occurred after the specified date.
2. Annotated output logs and screenshots from the tools above, clearly cross-referenced in the report.
3. The cleaned working copies you generated (no personal data removed from the original).
4. An executive-style summary I can forward to legal counsel.
The job is complete when the report convincingly shows either clear evidence of post-14 Sept 2025 and 20-October-2025 alteration or, if none exists, a defensible explanation of why the document remains unchanged.