±Forensic Focus Partners

Become an advertising partner

±Your Account


Forgotten password/username?

Site Members:

New Today: 3 Overall: 36489
New Yesterday: 5 Visitors: 156

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Videos

±Latest Jobs

Inconsistant PDF metadata

Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts


Inconsistant PDF metadata

Post Posted: Dec 14, 19 18:32

The suspected forged pdf document that I am working on has the Modified date (Filesystem) lesser than the Pdf creation date (info). Is this a clue for the forgery?

More details:

The pdf file is found in two different computers with the same "anomaly". It is "produced by" MS Word 10 and does have the section of XMP metadata XML (must be manually removed).

modified time (MFT) of two different copies of the same file:
Thu Apr 27 20:54:53.0000000 UTC+0530 2017

creation and modified time (info metadata, embedded inside the document):
2017-04-27 22:24:29

I have tested saving a word file as pdf, the creation and modification for MFT and Pdf info are exactly same.

I am new to such analysis, any help or comment is highly appreciated.  

Page 1 of 1