Lion Cipher Lab
Recover earlier versions of a PDF from its incremental updates
- Digital Forensics & IR (DFIR)
- Advanced
- ~90 min
- Free · no account required
Why it matters
Invoice and payment fraud often comes down to one question: what did this document say when it was approved, and who changed it afterwards? PDFs are unusually good witnesses, because the format lets a program save changes by appending them to the end of the file instead of rewriting it. The original bytes stay where they were, so an edited invoice can still carry the version that was signed, with the old amount and the old bank details intact. Investigators who know this can recover the earlier version in minutes and show exactly which objects changed and when the editing software says it…
What you'll learn
- Reading a PDF's file trailer by hand: startxref, %%EOF, the cross-reference table and the trailer's /Prev, /Size, /Root, /Info and /ID entries
- Explaining what an incremental update is (ISO 32000-1, 7.5.6) and why every earlier revision survives inside the saved file
- Counting revisions correctly by walking startxref -> xref -> /Prev, instead of counting %%EOF strings
- Recognising two false alarms: %%EOF inside text or a comment, and a linearized file's forward-pointing /Prev
- Cutting a PDF at a real revision boundary to recover a viewable earlier version
- Diffing revisions by object, Info dictionary (ModDate, Producer) and the changing second /ID string
- Inflating a FlateDecode stream with Python's zlib so a changed value is not missed by a raw-byte search
- Reading a signature's ByteRange to tell whether a signed PDF was changed after signing
Steps in this lab
- Why a saved PDF can still contain the version before it
- Build four evidence files by hand
- Read the end of the file the way a PDF reader does
- Count revisions two ways and watch the shortcut fail
- Open the recovered revisions
- Diff the revisions: which objects, which dates, which text
- Why a raw search found the old amount and missed the new one
- What the signature proves, and what it does not
- Honest limits: where this method stops
- When to reach for this, and how a professional does it