I gave four PDF inspectors the same six-save file

The awkward result was not a missed warning

One inspector found both old and current metadata, then presented them together: the title and author from the first save beside the creator and keywords from a later save. Every value existed in the bytes. The combined story never existed in any revision.

That is why this test is about provenance rather than the length of a results page. Finding a string is useful. Saying whether it belongs to the active document, an earlier save or an unreferenced object is the harder job.

What was in the file

The fixture starts as a normal five-page PDF, is converted to a classic cross-reference table, and is then saved incrementally five times. Four saves replace the document information dictionary. The final save adds an XMP packet that no active object references. A harmless named JavaScript action remains active.

This distinguishes three jobs that are often blurred together: finding strings, reconstructing the active object graph, and placing old objects on a revision timeline. A raw search can find an old author without establishing whether that author belongs to the current document.

Fixture

5,230 bytes · six revisions

SHA-256

178846e54dd8972a96ace6c9f6293eb402716e363a0b3dc5955997f39e131eff

Browser

Fresh headless Chrome 152 pages; extensions disabled

Pass condition

A value counted only when visible in the completed rendered result

What the table does and does not grade

Before loading the fixture, we recorded what each tool says it does on its own page. Then the table below records observed output, not marketing copy. “Six revisions” requires the correct count for this file. “Stale XMP” requires the planted packet to be placed outside the active graph. “JavaScript” requires the active named action to be surfaced. “Object / byte evidence” asks whether a reader can inspect where the result came from.

The fixture does not contain a real signed document, a malformed object stream, image manipulation or malware. Those capabilities are outside this comparison even when a tool offers them. Detecting JavaScript also does not mean a tool has decided whether the script is malicious.

What each inspector exposed

The detail behind the cells

There was no winner for every job

TrustPDF grouped active-content and revision findings into a compact security summary. Loreatec exposed qpdf’s complete object graph for direct browsing. Konvi used a lightweight pattern scan, though this fixture exposed the cost of reading old and current strings without reconstructing their revisions.

Lyonite’s edge in this test was the connection between layers: validated save boundaries, object reachability, decoded content and raw-byte provenance in the same workspace. Its optional reference comparison and signature verifier broaden that workflow, but this fixture did not grade those features. People who only want the current author and dates should still use the faster Metadata Viewer.

How the network observation was made

An automated Chromium session opened each public page, attached request logging, selected the fixture, and waited for the result. Lyonite and Konvi made no request after selection. Loreatec made no request carrying the file. TrustPDF made one 140-byte POST to a Supabase tool_usage endpoint; its body did not contain the PDF or planted values. That is telemetry, not evidence of a file upload.

This test says what happened in those sessions at the date above. It cannot prove what a site will do on another date, under a different feature flag, or with a different file. Browser extensions were disabled and each tool ran in a fresh page.

A request was treated as a possible file transfer if it was cross-origin after selection, used a method other than GET, carried a request body, or placed the filename or a long payload in a query string. Suspect requests were inspected separately; “no file request observed” is narrower than a claim that a site can never transmit a file.

What did not make the table

APIVoid returned an access-denied page in the test environment. DocuExprt displayed the selected filename but did not produce an analysis result through the automated upload flow. Metadata2Go is an upload service rather than a browser-only forensic inspector. None received a guessed score or a “failed” cell; a tool has to complete the same run before its output can be compared.

Where Power Mode goes further

The comparison changed the Lyonite design in one useful way: the advanced parser stays behind a deliberate toggle and a dedicated route. Selecting a PDF in the ordinary metadata viewer does not download the qpdf forensic module. Advanced users can open the revision chain, object classifications, signature coverage, visual comparison and hex window without turning the quick workflow into a cockpit. PDFium is fetched only if they start visual analysis.

Power Mode does not label a PDF authentic, fake or tampered. Incremental saves, unreferenced objects and mixed fonts occur in ordinary files. The report gives those observations provenance and an evidence level so a person can decide what they mean, ideally alongside a second independent parser for consequential work.

Reproduce it

Download the fixture and its ground truth above, verify its SHA-256, then run it through any inspector. Lyonite’s verifier is also part of the site source as scripts/forensics-verify.mjs. The public fixture checks the startxref and /Prev chain, historical information dictionaries, unreferenced XMP and JavaScript action. Separate verifier cases exercise valid and deliberately invalid signature ranges; the comparison table makes no signature claim.

Found a changed result? Email hello@lyonite.com. Corrections are re-run, dated and linked from the report; typical response time is 48.