On the use of TrueType fonts to forensically classify and date PDF documents

Olivier

2026

Citation information

Abstract

Forensic examination of a questioned digital documents should consider any artefact embedded in it that may help to answer forensic questions. Where a questioned document embeds one or more fonts, the obvious question whether such a font can shed any light on the document being examined. The paper suggests that embedded fonts show potential in two such areas. Firstly, it hypothesises that creation tools embed fonts in different ways. Hence, the manner in which fonts are embedded in a document may shed light on the tool used to create the document. Moreover, it is suggested that such tool marks may survive document editing, that may shed light on the tool used to create a document (or a part of a document) prior to any editing. Secondly, the paper suggests that fonts that are embedded often provide an earliest time at which the embedding document could have been created. The paper explores these claims through the creation and editing of simple documents. The primary objective of the paper is to illustrate that sufficient variety may be seen (even from simple examples) to support the claim that the variety in potentially sufficient to associate an embedding pattern that will in many cases be different for different tools.

BibTeX reference