On the classification of questioned PDF documents — Attributing PDF documents to the tools that created them

Olivier

2025

Citation information

Abstract

It is often useful in forensic science to attribute an object to the tool that created it. In traditional questioned documents, it may be useful to determine which typewriter was used to produce it. In ballistics, it may be useful to determine which firearm fired a round found on a crime scene. We suggest that it is similarly useful to determine which tool was useful to create a digital document. The current paper addresses the challenge of determining which tool created a PDF document.

The first challenge is to show that a given tool consistently leaves marks in a PDF file that may be different from marks left by other tools. This is the first problem that the current paper addresses. It identifies potential toolmarks and then verifies that such marks occur consistently in a large dataset. The dataset used is the 1000 PDF .gov dataset provided by the US Library of Congress.

Attribution of a creation tool aligns with the definition of classification provided by Inman and Rudin; they define a class as a set of objects that share a common origin. The paper extends the verification of consistency, by using the identified toolmarks to divide the dataset into classes with remarkable success.

Definitive version

Definitive version

BibTeX reference