arXiv · 2003.10546
Forensic Analysis of Residual Information in Adobe PDF Files
Abstract
In recent years, as electronic files include personal records and business activities, these files can be used as important evidences in a digital forensic investigation process. In general, the data that can be verified using its own application programs is largely used in the investigation of document files. However, in the case of the PDF file that has been largely used at the present time, certain data, which include the data before some modifications, exist in electronic document files unintentionally. Because such residual information may present the writing process of a file, it can be usefully used in a forensic viewpoint. This paper introduces why the residual information is stored inside the PDF file and explains a way to extract the information. In addition, we demonstrate the attributes of PDF files can be used to hide data.
Explore related subjects
Keep this discovery
Hyunji Chung, Jungheum Park, Sangjin Lee. 2020-03-09. Forensic Analysis of Residual Information in Adobe PDF Files. https://arxiv.org/abs/2003.10546
Cite the original work for its findings. Save a collection to share your selection of sources.