A case study in PDF forensics: The Epstein PDFs
This article details a PDF forensics case study on a small, random selection of the Epstein PDF files released by the US Department of Justice (DoJ). The tranche contains 4,085 PDF files, with an estimated 5,879 remaining unreleased. Key findings include:
- A difference in PDF version reporting between forensic tools.
- The presence of two incremental updates.
- The discovery of a hidden (orphaned) document information dictionary revealing the software used in processing.
- The DoJ avoided JPEG images to prevent metadata leakage.
- Overall, the DoJ’s sanitization workflow could be improved to reduce file size and information leakage.
A case study in PDF forensics: The Epstein PDFs
This article details a PDF forensics case study on a small, random selection of the Epstein PDF files released by the US Department of Justice (DoJ). The tranche contains 4,085 PDF files, with an estimated 5,879 remaining unreleased. Key findings include:
- A difference in PDF version reporting between forensic tools.
- The presence of two incremental updates.
- The discovery of a hidden (orphaned) document information dictionary revealing the software used in processing.
- The DoJ avoided JPEG images to prevent metadata leakage.
- Overall, the DoJ’s sanitization workflow could be improved to reduce file size and information leakage.
Tagging Images in PDF/UA-1 and PDF/UA-2
July 2025 by Paul Rayius (Allyant)
Article
Experience since PDF/UA-1 was published has revealed that some rules were too prescriptive. In some situations the semantic significance of an image is due to its representation of text, and … Read more
Visit Paul Rayius's profile.
