- Nationwide Digital Forensic & Cyber Investigation Services
Understanding PDF documents starts below the page you see. A PDF is a structured file of numbered objects, compressed streams, an index of byte positions, and a trailer. Every editing tool leaves its own pattern in that structure.
Home › Digital Evidence Authentication › PDF Authentication › PDF Document Structure Explained
Quick Answer. A PDF document is a structured file made of four parts: a header that names the PDF version, a body of numbered objects such as pages, fonts, and images, a cross reference table that records where each object starts, and a trailer that points to the document catalog. Forensic examiners read this structure to identify the creating software and detect editing.
This guide explains PDF document structure in plain language for attorneys, investigators, and anyone who needs to understand what a PDF really contains. It is part of our PDF Authentication series. Once you understand the structure, the other forensic tests, from magic bytes to incremental updates, make sense.
| Question | Short answer |
|---|---|
| What is a PDF file made of? | A header, a body of numbered objects, a cross reference index, and a trailer, ending with an end of file marker. |
| Who controls the PDF standard? | ISO. PDF 1.7 is ISO 32000 Part 1, and PDF 2.0 is ISO 32000 Part 2. |
| What is a PDF object? | A numbered building block such as a page, font, image, or dictionary, written between obj and endobj keywords. |
| Why does structure matter in forensics? | Each program writes objects in its own order and style, so structure fingerprints the software that made or edited the file. |
| Is the text in a PDF stored as text? | In born digital PDFs, usually yes, as positioned glyphs in content streams. In scans, the page is an image. |
| Can two identical looking PDFs differ inside? | Yes. Visual output can match while object layout, fonts, and metadata are completely different. |
A numbered PDF object, such as 12 0 obj, that other objects can reference by its number and generation.
A block of data, often compressed, holding page drawing instructions, images, fonts, or metadata.
The drawing instructions for a page: which glyphs, lines, and images to place at which coordinates.
The root object of a PDF, which points to the page tree, metadata, forms, and other document level data.
A compressed form of the cross reference table introduced in PDF 1.5, common in modern files.
A stream that packs many small objects together in compressed form to reduce file size.
The dictionary at the end of a PDF section that records the root, the Info dictionary, the document ID, and the previous cross reference offset.
An embedded font that contains only the characters actually used, named with a six letter tag and a plus sign.
Every conforming PDF follows the same high level layout defined in ISO 32000. The layout is simple, but the details each program writes are distinctive.
| Part | What it contains | Forensic value |
|---|---|---|
| Header | The characters %PDF and the version number, often followed by a comment line of high value bytes | Version must agree with the features used and with the claimed creating software |
| Body | Numbered objects: catalog, page tree, pages, content streams, fonts, images, metadata | Object order, numbering gaps, compression, and naming patterns fingerprint the producer |
| Cross reference | A table or compressed stream listing the byte offset of each object | Multiple sections reveal incremental saves; free entries reveal deleted objects |
| Trailer and end marker | Pointers to the root and Info dictionary, the document ID, startxref offset, and %%EOF | Document ID pairs and repeated end markers expose later modification |
We map every object in the file and compare it with genuine documents from the claimed source. Tell us about the document and we will explain what can be tested.
Request Confidential Consultation Call (833) 292 3733A PDF page is not a picture of text. It is an object that points to a content stream, a list of drawing instructions such as select this font, move to these coordinates, and show these glyphs. Fonts, images, and colors are separate objects the content stream refers to by name.
This design is why PDF editing leaves traces. When someone changes a number on a bank statement, the editor typically adds a new text instruction, sometimes with a different font subset, or paints a white rectangle over the old value and writes new text on top. The original instruction may still exist in the stream. Our PDF deepfake detection guide shows how examiners find these overlays.
Streams are usually compressed with Flate compression, while images use filters suited to photographs or scanned pages. A forensic parser decompresses every stream so that the drawing instructions, hidden text, and embedded files can be read directly rather than through a viewer that only shows the final result.
Most software embeds only the characters it needs, creating a subset with a random six letter prefix. A genuine statement normally uses a small, consistent set of subsets. An edited value drawn with a separate subset, or a font that the issuing system never uses, is a strong structural signal.
The same document exported from two programs produces very different internal structure. That is why examiners compare a disputed PDF with genuine reference files from the same issuer.
| Structural trait | System generated statement | Office export | Online editor or converter |
|---|---|---|---|
| Object order | Fixed, repeated pattern every month | Predictable for that program version | Often reordered or renumbered on save |
| Cross reference style | Usually one section | Table or stream, one section | Extra appended sections after edits |
| Fonts | Same subsets across statements | Fonts from the author's computer | Mixed subsets or substituted fonts |
| Metadata | Consistent Producer, sometimes minimal | Creator and Producer for the office suite | Producer naming the editor or conversion library |
| Document ID | Both parts equal on delivery | Both parts equal on first export | Second part changed after modification |
Structure is strong evidence of how a file was produced and whether it was later changed. It shows which software touched the file, whether objects were added or replaced, and whether earlier versions survive. It cannot, on its own, prove who pressed save, or whether a genuine looking document reflects true facts. Those questions require corroboration from the source system, email records, or witnesses, which is why structure is one layer of a complete PDF authentication examination.
Structural analysis is performed on a preserved, hash verified copy so the original is never modified.
We parse PDF structure at the object level, decompress every stream, map cross reference sections and document identifiers, and compare the result with genuine reference documents from the claimed issuer. We explain what the structure shows about creation and editing in a written report suitable for attorney review, negotiation, or court, and we testify to those findings when needed. Our analysts are subject matter experts in PDF document structure, which lets them read the header, body, cross reference table, and trailer directly instead of relying on a viewer.
Elite Digital Forensics is an independent digital forensics practice serving attorneys, paralegals, in house counsel, insurers, lenders, businesses, and individuals nationwide. Our team includes former law enforcement forensic examiners and court qualified expert witnesses in computer, cell phone, cloud, document, and multimedia forensics. Every engagement begins with a scoped plan, hash verified evidence handling, and a clear explanation of what the examination can answer.
A PDF has a header with the version number, a body of numbered objects, a cross reference table or stream giving each object's byte location, and a trailer that points to the document catalog, followed by an end of file marker.
The International Organization for Standardization publishes PDF as ISO 32000. Part 1 covers PDF 1.7 and Part 2 covers PDF 2.0.
Edits usually add objects, new cross reference sections, new font subsets, or overlay instructions. These changes differ from the structure the original software produced and can be identified and documented.
It is an index that lists the byte offset of each object in the file so a reader can locate it quickly. Extra cross reference sections often indicate the file was saved again after creation.
When text is changed, the editor may embed a new subset of the font or substitute a similar font. The page can look the same while the font objects reveal the change.
A text editor shows fragments, but most streams are compressed. Forensic parsing decompresses and catalogs every object so the full structure can be examined and reported.
Send us the details through our secure contact page. We will explain what the file structure can show and how the examination would be scoped. Our court qualified experts in PDF forensics can walk the court through how the internal structure supports or contradicts the claimed history.
Request Confidential Consultation Call (833) 292 3733This content is for educational and informational purposes only and does not constitute legal advice. Elite Digital Forensics provides independent digital forensic services and expert witness testimony; we do not provide legal representation. Every case is fact specific; outcomes depend on the evidence, jurisdiction, and counsel. Retain qualified legal counsel for advice about your matter.
Elite Digital Forensics Assistant
By submitting this form, you consent to be contacted by email, text, or phone. Your information is kept secure and confidential. Reply Stop to opt out at anytime.
IMPORTANT: Please remember to check your spam or junk folder