Document manipulation goes beyond image editing. This module covers techniques for detecting altered PDFs, modified spreadsheets, fabricated screenshots, and forged official documents.
PDF Manipulation Detection
PDFs are among the most commonly manipulated document types. Common alterations include changing text content, swapping pages, modifying dates, and altering financial figures. Forensic analysis examines the internal PDF structure for signs of editing.
Structural Analysis
PDFs contain a cross-reference table tracking every object. Edits create incremental updates that trained analysts can detect by examining the revision history within the file structure.
Font Analysis
Inserted or modified text often uses a different font rendering than the original. Even subtle differences in hinting, kerning, or subpixel rendering can reveal edits.
Screenshot Forensics
Fabricated screenshots are increasingly common in fraud and misinformation. Detection focuses on UI consistency checks — do the fonts, colors, spacing, and interface elements match the claimed platform? Does the screenshot resolution match the claimed device?
Spreadsheet Manipulation
Modified spreadsheets may retain traces in cell formatting, formula references, named ranges, and file metadata. The undo history, when present, can reveal the sequence of modifications.
Red Flags
• Font inconsistencies within the same document section
• Misaligned text baselines or grid positions
• Metadata showing creation in one tool but content created in another
• Compression artifacts around text regions only
• Creation date after the claimed date of the document
Document manipulation detection connects to Forensic Image Analysis for visual elements and Metadata Analysis for file-level examination.