- Nationwide Digital Forensic & Cyber Investigation Services
PDF magic bytes are the first bytes of a file that identify it as a PDF regardless of its name or extension. Examiners use them, together with the end of file marker, to confirm the format, detect disguised files, and find hidden data.
Home › Digital Evidence Authentication › PDF Authentication › PDF Magic Bytes and File Signatures
Quick Answer. PDF magic bytes are the file signature at the start of every PDF: the characters %PDF, a separator, and a version number, written in hexadecimal as 25 50 44 46 2D. A PDF normally ends with the marker %%EOF, hex 25 25 45 4F 46. Forensic examiners check these signatures to confirm a file is truly a PDF and to detect disguised, appended, or hidden data.
This guide explains PDF magic bytes and file signature analysis. It is part of our PDF Authentication series. File signature analysis is usually the first test in a forensic examination, before structure and metadata are examined.
| Question | Short answer |
|---|---|
| What are magic bytes? | The fixed opening bytes of a file that identify its true format, independent of the file extension. |
| What are the PDF magic bytes? | Hex 25 50 44 46 2D, which reads as %PDF followed by a separator, then the version number. |
| Where must the PDF header appear? | At the start of the file. Many readers tolerate it within the first 1024 bytes, which can hide data placed before it. |
| What marks the end of a PDF? | The %%EOF marker. Files saved incrementally contain more than one. |
| Can a file be renamed to look like a PDF? | Yes. The extension can say PDF while the magic bytes reveal another format, or the reverse. |
| What is a polyglot file? | A file crafted to be valid as two formats at once, such as a PDF that is also an archive or script. |
A fixed sequence of bytes at a known position that identifies a file format. Also called a file signature.
A base 16 notation used to write byte values, where 25 50 44 46 represents the characters %PDF.
The first line of a PDF, giving the signature and version number.
A second header line of high value bytes that signals the file contains binary data.
The %%EOF line that closes each saved section of a PDF.
A file that is simultaneously valid in two or more formats, often used to hide content or evade filters.
File signature analysis reads raw bytes rather than trusting the file name. These are the values examiners look for in a PDF.
| Location | Hex bytes | Characters | Meaning |
|---|---|---|---|
| Start of file | 25 50 44 46 | Identifies the file as a PDF | |
| Byte 5 | 2D | separator | Separates the signature from the version |
| Bytes 6 to 8 | 31 2E 37 | 1.7 | Version number, here PDF 1.7 |
| Second line | 25 E2 E3 CF D3 | % and high bytes | Binary comment written by many producers |
| End of each section | 25 25 45 4F 46 | %%EOF | Marks the end of a saved section |
The exact bytes of the binary comment line vary by producer, which makes it a small but useful software fingerprint when compared with genuine documents.
We verify file signatures, hidden data, and appended content as the first step of every examination. Tell us about the file and we will explain what can be tested.
Request Confidential Consultation Call (833) 292 3733A file named statement.pdf that begins with the signature of an image, archive, or executable is not a PDF. The reverse also happens: a PDF renamed with another extension to avoid notice. Examiners record both the claimed and the true format.
Because many readers accept a header that appears shortly after the start of the file, data can be placed before it. Those extra bytes may be harmless, but they can also hide another file or indicate the document was wrapped by unusual software.
Readers ignore bytes after the last %%EOF. That space can hold appended files, leftover data from a careless save, or concealed content. Its presence is documented and the data is extracted for analysis.
Several %%EOF markers usually mean the file was saved incrementally, with each save appending a new section. That is the starting point for revision recovery, covered in PDF incremental updates and edit history.
The version number in the header should be consistent with the features inside the file and with the software that supposedly created it.
| Header version | Typical features | Forensic check |
|---|---|---|
| 1.3 and 1.4 | Classic cross reference tables, basic transparency | Common in older systems and simple converters |
| 1.5 and 1.6 | Cross reference streams and object streams | Compressed structure appearing under a lower header can indicate rewriting |
| 1.7 | ISO 32000 Part 1 features | The most common version for system and office generated documents |
| 2.0 | ISO 32000 Part 2 features, Info dictionary deprecated | Should align with modern producers and XMP based metadata |
The catalog can also declare a later version than the header, which is legitimate in incremental updates. A mismatch between the declared version, the features present, and the claimed software is recorded and explained.
A polyglot is crafted to be valid in two formats at once, for example a PDF that is also a ZIP archive or contains an embedded script. Polyglots are used to smuggle content past filters, deliver malware, or present different content to different readers. In evidence, a polyglot or a document with unexplained embedded files raises questions about intent and authenticity, and its components are separated and examined individually.
| Attribute | Ordinary PDF | Suspicious PDF |
|---|---|---|
| First bytes | %PDF signature at offset zero | Other data before the signature |
| Last bytes | Final %%EOF with a line ending | Unexplained data after the final marker |
| Embedded files | None, or expected attachments | Hidden archives, scripts, or other documents |
| Extension | Matches the signature | Does not match the signature |
Signature analysis is fast, but it is documented as carefully as any other test.
We perform file signature analysis as the first step of every PDF examination. We confirm the true format, locate every end marker, extract any hidden or appended data, check version consistency, and document each value by byte offset. These findings feed directly into our structural, metadata, and revision analysis and are explained in plain language in our reports. This work is led by subject matter experts in file signature analysis who read PDF headers and end of file markers at the byte level.
Elite Digital Forensics is an independent digital forensics practice serving attorneys, paralegals, in house counsel, insurers, lenders, businesses, and individuals nationwide. Our team includes former law enforcement forensic examiners and court qualified expert witnesses in computer, cell phone, cloud, document, and multimedia forensics. Every engagement begins with a scoped plan, hash verified evidence handling, and a clear explanation of what the examination can answer.
A PDF begins with hex 25 50 44 46 2D, which reads as %PDF followed by a separator, then the version number such as 1.7. The file normally ends with %%EOF, hex 25 25 45 4F 46.
Open it in a hex viewer and read the first bytes. Forensic tools compare them with a database of known signatures and also scan for embedded and trailing data.
Each incremental save appends a new section that ends with its own marker. Several markers usually mean the file was edited or updated after it was first created.
No. They confirm the format only. Alteration is tested through structure, metadata, revisions, fonts, and signatures.
A file crafted to be valid both as a PDF and as another format, such as an archive. Polyglots can hide content and are treated as a significant finding in an examination.
It can be harmless leftover data, but it can also hide files or content. It is always extracted and identified in a forensic examination.
Send us the details through our secure contact page. We will explain what the raw bytes can show and how the examination would be scoped. Our court qualified experts in PDF forensics can testify to what the raw bytes prove about the file.
Request Confidential Consultation Call (833) 292 3733This content is for educational and informational purposes only and does not constitute legal advice. Elite Digital Forensics provides independent digital forensic services and expert witness testimony; we do not provide legal representation. Every case is fact specific; outcomes depend on the evidence, jurisdiction, and counsel. Retain qualified legal counsel for advice about your matter.
Elite Digital Forensics Assistant
By submitting this form, you consent to be contacted by email, text, or phone. Your information is kept secure and confidential. Reply Stop to opt out at anytime.
IMPORTANT: Please remember to check your spam or junk folder