Create an account Home  ·  Topics  ·  Downloads  ·  Your Account  ·  Submit News  ·  Top 10  
Modules
· Home
· Content
· FAQ
· Forensic Downloads
· Forensics Feedback
· Forums
· Members List
· Statistics
· Surveys
· Top 10
· Topics
· Training Reviews
· Web Links
· Your Account

Our Membership

Latest: monne642
New Today: 1
New Yesterday: 2
Overall: 29618

Computer Forensics
This is a free and open peer to peer medium for digital and computer forensics professionals and students. Please help us maintain it by contributing and perhaps linking to us from your own website.

Recent Posts

 How much can be found?
 Computer Forensic in responding to Data Breach issues
 A bunch of numbers about digital evidences collection
 Computer forensic issue
 A Survey on the Internet of Things Digital Forensic Research

Computer Forensics World Forums


Pages Served
We received
58156369
page views since August 2004

Security Sources

FTC
OnGuard Online
ISO 17799 ISO 27001
ISO 27000 Toolkit
ISO 27001 & 27000
Cryptography
Security Policies

Computer Forensics World: Forums

Computer Forensics World :: View topic - unauthorized changes in PDF file
 Forum FAQForum FAQ   SearchSearch   UsergroupsUsergroups   ProfileProfile   Log in to check your private messagesLog in to check your private messages   Log inLog in 

unauthorized changes in PDF file

 
Post new topic   Reply to topic    Computer Forensics World Forum Index -> Technical Issues
View previous topic :: View next topic  
Author Message
homer76
Newbie
Newbie


Joined: Jul 19, 2015
Posts: 2

PostPosted: Wed Aug 26, 2015 10:31 pm    Post subject: unauthorized changes in PDF file Reply with quote

Hello everyone and greetings

I have some documents in PDF file format, some of them have been modified aim to defraud the loan (change of name, account number).

What a tool I can quickly identify recently entered data into a file?

Best regards
Homer
Back to top
View user's profile
cybercop
Newbie
Newbie


Joined: Nov 01, 2005
Posts: 551
Location: Marion, Indiana, USA

PostPosted: Wed Aug 26, 2015 11:40 pm    Post subject: Reply with quote

In the immortal words of the musical artist Meatloaf "Stop right there ....".

First, all parties involved would / should have copies of the original contract.

This sounds like a case for an actual forensics investigator. If this is a real case and one party is trying to commit fraud, you do not want to be mucking around with files.

If it is a real case, there is a very good possibility criminal charges may be in order.

Contact a computer forensics investigator in your area and have them do the work they are trained to do (properly). Anything you do can only harm a case.
Back to top
View user's profile
homer76
Newbie
Newbie


Joined: Jul 19, 2015
Posts: 2

PostPosted: Thu Aug 27, 2015 5:38 pm    Post subject: unauthorized changes in PDF file Reply with quote

Thank you for the advice - I agree with your thesis

I am a forensics investigator for 2 years, my area of operation is the data analysis, media analysis, image analysis and data recovery

Analysis of PDF files for me is a new task assigned by the Court - (reale case)

Today I know the topic of analysis pdf files know how
- read metadata,
- export objects from a pdf file,
- check the structure and composition of the pdf file
- I know that the new data is written at the end of the file.
- The old content can be labeled not removed from pdf file (good for us)
- And more;) the internet is a great book of knowledge

I do not know if there are markers telling when or in what order you made a change to a pdf file.

In my country there is no training in data analysis this is why iI'm looking a support on this website

If anyone can help I will be grateful,
Back to top
View user's profile
athulin
Newbie
Newbie


Joined: Oct 19, 2007
Posts: 241

PostPosted: Fri Aug 28, 2015 3:03 am    Post subject: Re: unauthorized changes in PDF file Reply with quote

homer76 wrote:
I do not know if there are markers telling when or in what order you made a change to a pdf file.


The PDF Reference Manual (I think it is called) will probably be required reading.

It is possible to 'update' a PDF file, by adding new objects, and relinking structures to refer to them. However, it's not usual to see that. Some Adobe tools used to 'update' when you just 'Save', and create a new document when you 'Save as ...', but this will be application dependent, not PDF dependent. While PDF provides the mechanism for an 'update', it's up to the application (and perhaps the user) to decide if that mechanism will be used at all.

I suspect you need to figure out what application was used or may have been used to create the PDF, and then see if it leaves any traces from updates.
Back to top
View user's profile
Display posts from previous:   
Post new topic   Reply to topic    Computer Forensics World Forum Index -> Technical Issues All times are GMT + 10 Hours
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum

Powered by phpBB 2.0.10 © 2001 phpBB Group
phpBB port v2.1 based on Tom Nitzschner's phpbb2.0.6 upgraded to phpBB 2.0.4 standalone was developed and tested by:
ArtificialIntel, ChatServ, mikem,
sixonetonoffun and Paul Laudanski (aka Zhen-Xjell).

Version 2.1 by Nuke Cops 2003 http://www.nukecops.com

Forums ©

 

TMs property of their respective owner. Comments property of posters. 2007 Computer Forensics Science World.
Digital forensic computing news syndication: Computer Forensics Training News or UM Text
Software is copyrighted phpnuke.org (c)2003, and is free under licence agreement. All Rights Are Reserved.