Forensic analysis of residual information in adobe PDF files

Hyunji Chung, Jungheum Park, Sangjin Lee

Research output: Chapter in Book/Report/Conference proceedingConference contribution

2 Citations (Scopus)


In recent years, as electronic files include personal records and business activities, these files can be used as important evidences in a digital forensic investigation process. In general, the data that can be verified using its own application programs is largely used in the investigation of document files. However, in the case of the PDF file that has been largely used at the present time, certain data, which include the data before some modifications, exist in electronic document files unintentionally. Because such residual information may present the writing process of a file, it can be usefully used in a forensic viewpoint. This paper introduces why the residual information is stored inside the PDF file and explains a way to extract the information. In addition, we demonstrate the attributes of PDF files can be used to hide data.

Original languageEnglish
Title of host publicationFuture Information Technology - 6th International Conference, FutureTech 2011, Proceedings
Number of pages10
EditionPART 2
Publication statusPublished - 2011
Event6th International Conference on Future Information Technology, FutureTech 2011 - Loutraki, Greece
Duration: 2011 Jun 282011 Jun 30

Publication series

NameCommunications in Computer and Information Science
NumberPART 2
Volume185 CCIS
ISSN (Print)1865-0929


Other6th International Conference on Future Information Technology, FutureTech 2011


  • Data hiding
  • Digital evidence
  • Information leakage
  • PDF
  • Residual Information

ASJC Scopus subject areas

  • General Computer Science
  • General Mathematics


Dive into the research topics of 'Forensic analysis of residual information in adobe PDF files'. Together they form a unique fingerprint.

Cite this